SSL certificates explained: what they are and why your site needs one

Somewhere along the way, SSL became the most resold, least understood line item on hosting invoices. This guide untangles it: what a certificate actually does, why the padlock advice you have heard is now out of date, why free certificates are usually fine and how to check your own setup in ten minutes. Two ideas carry the whole article. HTTPS secures the connection, not the business behind it. And free versus paid has nothing to do with weak versus strong encryption.

The straight answer: yes, your business website should use HTTPS

A modern public business website should be served over HTTPS, across the whole site, all the time. HTTPS protects the information moving between a visitor's browser and your website from being casually read or modified in transit: contact form submissions, login details, customer accounts, checkout, bookings, cookies and the page content itself. Google's web security guidance is blunt about the scope: protect all your websites with HTTPS, even the ones that do not obviously handle sensitive information.

SSL or TLS? Why people use both terms

SSL, Secure Sockets Layer, was the earlier technology and its old versions have long been deprecated. TLS, Transport Layer Security, replaced it and is what every modern secure connection actually uses; the current major version, TLS 1.3, is the standard maintained by the internet's engineering community, the IETF. But SSL certificate became the everyday commercial term and hosts, certificate authorities, developers and business owners all still say it. So this article says SSL certificate too, because that is what people search for and buy, while being clear that what you are getting today is a TLS certificate.

HTTP vs HTTPS in plain English

HTTP is the web's basic delivery protocol: http://example.com, with nothing protecting the information as it travels. HTTPS is the same protocol wrapped in TLS: https://example.com, with the connection encrypted and authenticated before any normal communication happens. TLS is specifically designed to prevent eavesdropping, tampering and forged communication while data crosses the network between browser and server.

The sealed envelope analogy

HTTP is a postcard. Anyone handling it along the way, on the café wifi, at the network level, anywhere between the visitor and your server, can potentially read it or write on it. HTTPS is a sealed, tamper evident envelope delivered through an authenticated channel: the browser first checks it is really talking to your server, then both sides agree on encryption and only then does the conversation start. Google's web security material makes the same point less politely: intruders exploit every unprotected resource travelling between a website and its users and that includes legitimate but intrusive parties injecting ads, not just criminals.

What does an SSL certificate actually do?

Three jobs and only three.

1. Helps authenticate the website connection

When a browser connects, the server presents its certificate. The browser checks it is valid for that domain and chains back to a certificate authority the browser trusts. Let's Encrypt, for example, verifies that the applicant actually controls the domain before issuing its certificates. This is what stops a random server on the network simply pretending to be yours.

2. Enables encrypted communication

Once the secure connection is established, the information travelling in both directions is encrypted: form submissions, session cookies, page requests, account interactions, transactions. Someone watching the network sees that a conversation is happening, not what it says.

3. Helps protect data integrity

TLS also makes it very hard for anyone sitting between the visitor and the server to modify the communication without detection. The page your server sent is the page the visitor receives, which matters more than most owners realise, because injected scripts and altered content are attacks on your visitors wearing your brand.

Browser → TLS handshake and certificate check → encrypted connection → website server

The whole process happens in milliseconds, before the page loads. If the check fails, the visitor sees a warning instead of your website.

HTTPS does not mean the website itself is safe or trustworthy

Here is the part the industry keeps quiet because fear sells certificates. A valid certificate does not prove the business is reputable, the products are genuine, the website is free of malware, the WordPress installation is secure, the operator will deliver what they promise, the site cannot be hacked or that customer data is stored safely after it arrives. Let's Encrypt says this itself about its own certificates: domain validation confirms control of the domain, not the real world identity, reputation or safety of whoever operates it. Phishing sites use HTTPS too, precisely because it is free and easy.

What happened to the website padlock?

For decades, look for the padlock was the standard security advice and it is now officially out of date. Chrome retired the lock icon in Chrome 117, back in September 2023, replacing it with a neutral tune style settings icon. The reason is the whole thesis of this article: Google's own research found the overwhelming majority of users thought the lock vouched for the website itself, when it only ever described the connection. In one Chrome study, just 11 percent of people correctly understood what the icon meant.

So retire the old advice. Instead of hunting for a padlock, check that the address starts with https://, that the browser reports the connection as secure when you open the site information panel, that no certificate warning appears and that the certificate is valid for the domain you are actually visiting. Browsers still make insecure sites obvious; they have simply stopped implying that a secure connection equals a trustworthy website, which was never true.

Does a simple brochure website really need SSL?

Yes. A brochure site still receives contact form details, sets cookies, loads scripts, runs analytics and transmits page content and every one of those travels the same networks as a bank's traffic. Google's guidance recommends HTTPS even for sites that do not appear to handle sensitive information, because unencrypted requests expose what visitors are doing and let the content itself be modified in transit. There is also a quieter reason: the details people type into your enquiry form deserve the same care as a checkout and forms that deserve the details people type into them start with a secure connection underneath. Anyone still saying only ecommerce websites need SSL is repeating advice from about 2015.

Free vs paid SSL certificates: do you need to pay?

For most normal small business websites, a properly configured free domain validation certificate is enough to run HTTPS, full stop. Let's Encrypt, run by the nonprofit Internet Security Research Group, issues free, browser trusted, automatically renewable certificates and most decent hosting providers now handle the issuing and renewing for you behind the scenes.

Free SSL

A Let's Encrypt certificate gives you domain validation, a certificate every major browser trusts, working HTTPS and automated renewal where the hosting is configured properly. Its standard certificates run 90 days by design, built around automation rather than manual renewal. That covers brochure sites, service businesses, blogs, WordPress sites, standard business websites and plenty of ecommerce implementations.

Paid SSL

Commercial certificate products differ through what sits around the certificate: organisation identity validation, support arrangements, certificate management tooling, enterprise deployment, specialist domain requirements, commercial warranties. Organisation validation verifies details about the business itself on top of domain control; Let's Encrypt deliberately offers domain validation only, because identity checks cannot be automated.

Is free SSL enough for a small business?

Usually, yes. If your host provides trusted automatic certificate issuance, reliable renewal, current TLS configuration and HTTPS redirection, a typical brochure or service business gains little from buying a separate certificate because paid sounds more secure. Investigate paid or specialist options when organisation level identity validation is specifically required, enterprise certificate management is involved, a contract or compliance requirement names it, multiple specialised domains and services are in play or the organisation needs commercial certificate authority support.

Single domain, wildcard and multi domain certificates

Quickly, because most owners never need to choose these personally. A single domain certificate covers a defined hostname setup. A wildcard covers the subdomains under a domain, so shop, portal and help can share one certificate. A multi domain certificate carries several different domain names in one. For a typical small business, the host, developer, CDN or managed platform picks the right structure automatically; this becomes your problem only if you run genuinely complex infrastructure.

SSL certificates expire and lifetimes are shrinking fast

Certificates are issued for limited periods by design and here is the part most SSL articles have not caught up with: those periods are getting dramatically shorter, industry wide, right now. The CA/Browser Forum, the body that sets the rules for publicly trusted certificates, voted in 2025 to step maximum lifetimes down from the old 398 days. Since 15 March 2026, new public TLS certificates are capped at 200 days. That drops to 100 days in March 2027 and 47 days by March 2029. Let's Encrypt has announced its own certificates will shorten from 90 to 45 days by 2028 under the same rules.

Read that as the industry formally ending the era of the annual manual renewal. A certificate you renew by hand once a year is already impossible to buy at the old length and within a few years the cadence will be monthly. Automation stopped being best practice and became the only workable approach.

When renewal fails, visitors meet certificate errors and secure connection failures instead of your website. The usual culprits: renewal automation broke, DNS changed, hosting changed, domain validation failed, the certificate was installed incorrectly, it covers the wrong hostname or the certificate chain is misconfigured.

What happens if your website does not use HTTPS?

Browsers warn your visitors

Chrome flags sites without a private connection as not secure and tells visitors that information they send or receive could be viewed or changed; users who enable its always use secure connections setting get an explicit warning before an insecure site even loads. As first impressions go, a security warning is a rough one and if you are paying for clicks, it is worse: whoever runs your search campaigns is buying traffic that a browser then greets with a caution sign, which is one of the sillier ways to fund landing pages that quietly leak paid clicks.

Form data travels without TLS protection

Names, phone numbers, emails, enquiry details, credentials and cookies cross the network readable, depending on what the site collects. Nobody has to breach your server to see it; they just have to be somewhere along the path.

Website content can be tampered with in transit

HTTPS protects the integrity of the HTML, JavaScript, images and cookies between server and visitor. Without it, what you published and what the visitor sees are only hopefully the same thing.

Modern browser features refuse to run

A growing list of web platform capabilities, service workers and various permission based APIs among them, require a secure context and simply will not function over plain HTTP. Staying on HTTP quietly locks the site out of features the modern web assumes.

Does HTTPS help SEO?

Modestly and be suspicious of anyone who says otherwise. Google announced HTTPS as a ranking signal back in 2014 and described it then as lightweight and its documentation says its systems generally prefer HTTPS pages over equivalent HTTP versions where the implementation is clean. So HTTPS is the correct technical standard, Google prefers it and staying on HTTP is an unnecessary weakness. What it is not is a growth lever: content, relevance and authority decide what actually moves organic rankings and installing a certificate changes none of them.

Installing the certificate is only half the job

The classic failure: HTTPS works, but the old HTTP version keeps working separately beside it, splitting the site into duplicate versions with inconsistent links. A proper implementation includes permanent redirects from HTTP to HTTPS, canonical URLs on HTTPS, an HTTPS sitemap, internal links updated to HTTPS and every asset loading over HTTPS. Google's documentation specifically recommends redirecting the HTTP versions and keeping canonical and sitemap signals consistent and the SEO checklist for moving from HTTP to HTTPS walks the full sequence so rankings survive the change. Afterwards, getting Search Console watching your site confirms Google is indexing the secure version and nothing else.

What is mixed content?

Mixed content is an HTTPS page still loading some resources over plain HTTP: an image, a JavaScript file, CSS, an iframe, a video, a third party widget. Browsers restrict or block insecure resources on secure pages because they undo the protection HTTPS promised. It usually appears after a migration, from hard coded image URLs, old theme files, embedded scripts, stale CDN addresses or external widgets. The fix is to update those resources to HTTPS or replace them with secure alternatives, not to find a way to hide the browser warning. The warning is doing its job.

Will SSL make my website slower?

Technically, establishing a TLS connection involves a negotiation step, so there is work happening. Practically, modern browsers and servers are built around secure connections and HTTPS is normal infrastructure, not a performance exotic. If your site is slow, the cause is almost certainly images, scripts, hosting, plugins, third party tools, an inefficient theme or missing caching rather than the encryption. Start with finding what is genuinely slowing your site down, then work through the fixes that make a real speed difference, measuring against the speed metrics Google actually reports on. One genuinely useful technical note: an HTTP to HTTPS redirect adds a hop when someone arrives on the old address, which is partly why Chrome has been moving toward trying HTTPS first, connecting straight to the secure version skips the detour entirely.

How to check whether your SSL certificate is working

Ten minutes, no tools you do not already have.

Step 1: open the website with HTTPS

Type https://yourdomain.com directly. The page should load, the correct site should appear and no browser error should interrupt.

Step 2: check both www and non www versions

Test https://example.com and https://www.example.com. One redirecting to the other is fine and normal; what matters is that both routes end at a valid, error free page.

Step 3: test the old HTTP address

Open http://example.com. It should redirect permanently to the HTTPS version, which is exactly what Google recommends for consolidating the secure site. If the HTTP version loads and stays, the migration was never finished.

Step 4: inspect the browser's connection information

Click the icon beside the address, the tune icon in Chrome and open the site information. Confirm the connection is reported as secure. This replaces the old padlock hunt.

Step 5: inspect the certificate

From the same panel, view the certificate: the domain name it covers, who issued it, the validity period and expiry date. An expiry inside the next couple of weeks with no automation in place is a problem you have caught early.

Step 6: check the important pages, not just the homepage

Contact, checkout, booking, login, account pages, forms, campaign landing pages. Certificates are site wide but mixed content is per page, so the pages where people type things deserve individual attention.

Step 7: check for mixed content

Open the browser's developer tools and look at the security panel and console for warnings about insecurely loaded resources, which is exactly what Google's own developer guidance recommends them for. Fold the whole routine into the wider half hour audit of your whole site once or twice a year and HTTPS problems stop getting the chance to age.

Why does my website still say not secure?

Working backwards from most to least common: the certificate has expired because renewal failed. The certificate does not cover the hostname being visited, working on one address but not another. The certificate chain or installation is broken, so the browser cannot validate it. The page has mixed content. Visitors are reaching the HTTP version because the redirect was never set up. Old internal links still point at HTTP URLs. The CDN and the origin server disagree about HTTPS. Or the TLS configuration itself is obsolete and modern browsers are refusing to negotiate with it.

An SSL certificate does not replace website security

With HTTPS running, you still need software updates, strong passwords, multi factor authentication, working backups, secure hosting, access control, malware protection, monitoring and a recovery plan. Picture the failure mode: an attacker compromises a badly maintained WordPress site that has perfectly valid HTTPS. Every visitor now enjoys an encrypted connection to a compromised website. The envelope is sealed; the letter inside is poisoned. That is why securing a WordPress site beyond the certificate and a backup routine that actually restores sit beside HTTPS rather than behind it and why the certificate is one layer of the stack, never the stack itself.

SSL protects the connection. The rest protects the website. A security strategy is the whole stack, not the top row.

Should SSL be included with website hosting?

For modern small business hosting, automatic certificate provisioning should be part of the package and hosting that handles certificates automatically is the standard worth insisting on. Ask directly: is SSL included, who issues it, does it renew automatically, who gets alerted if renewal fails, does it cover both www and non www, is HTTPS redirection configured and what happens to the certificate if we change hosting? That last one matters more than it used to, because certificates are tied to the server setup, which is one of the moving parts in the safe sequence for changing hosting or developers.

Small business SSL and HTTPS checklist

Certificate

Website

SEO

Security

Common SSL myths, corrected

Only ecommerce websites need SSL

Out of date by a decade. Every modern business site should use HTTPS: browsers, Google and the direction of the web platform all assume it.

The padlock means a website is safe

It never did and Chrome retired the padlock partly because so many people believed this. A secure connection to a scam is still a scam.

Free SSL certificates are not really secure

Free domain validation certificates from a trusted authority enable the same TLS encryption as paid ones. Price buys validation depth and services, not stronger ciphers.

Paid certificates rank better in Google

No. Google's signal relates to HTTPS itself, not to what the certificate cost. A free certificate and a $400 one look identical to a search engine.

SSL makes websites slow

Modern TLS overhead is negligible next to images, scripts and hosting quality. If the site is slow, the certificate is the last suspect on the list.

Once SSL is installed, security is sorted

The certificate is one layer. Updates, backups, access control, hosting and monitoring are the rest of the stack and attackers go around the sealed envelope, not through it.

Certificates last for years, set and forget

The opposite is now true. Maximum lifetimes dropped to 200 days in March 2026 and are heading to 47 days by 2029. Set and forget is being retired industry wide, in favour of automate and monitor.

A certificate warning is just cosmetic

A certificate error means the browser cannot verify it is talking to the right server. Visitors are right to turn around at that screen and most of them do.

Our honest take: SSL should be boring

HTTPS is one of the rare parts of web infrastructure that is genuinely solved. Free certificates exist, automation is mature, hosts handle renewal, browsers handle the rest. On a properly run website, SSL should be invisible: configured correctly at launch, renewed automatically, monitored quietly and never thought about again until an alert fires. If SSL keeps demanding your attention, through renewal dramas, recurring warnings or surprise invoices, the problem is not certificates. It is the setup or the person selling you the setup.

That is the standard across our website design and maintenance work: HTTPS configured properly on day one, redirects and canonicals done, renewal automated and monitored and the certificate line on the invoice either free or explained. It is also the standard in the launch day QA list we run before anything goes live and in the QA list we use for any relaunch, because HTTPS is exactly the kind of thing that breaks quietly during a rebuild. And since the connection is only the start of looking after customer information, what Australian privacy law expects around the information forms collect is the natural next read: encrypt it in transit, then handle it properly once it arrives. For sites where trust is the entire sale, websites for finance businesses, where trust does the selling and the checkout side of the stores we build, none of this is optional polish. It is the floor.

FAQs

What is an SSL certificate in simple terms?

A digital credential that lets browsers verify they are connecting to the right server and then encrypt the conversation. It is what puts the S in HTTPS.

What is the difference between SSL and TLS?

SSL was the original technology; TLS is its modern replacement and what every secure connection actually uses today. SSL certificate survives as the everyday commercial name.

Do all websites need SSL?

Every modern public business website should use HTTPS, whatever it sells or does not sell. Browsers flag HTTP as not secure and parts of the modern web platform require a secure connection.

Does my website need SSL if I do not sell anything?

Yes. Contact forms, cookies, logins and the page content itself all travel the network and Google recommends HTTPS even for sites without obviously sensitive data.

Is a free SSL certificate good enough?

For most small business websites, yes. Free domain validation certificates from a trusted authority like Let's Encrypt provide fully trusted HTTPS. Pay when you specifically need organisation validation, enterprise management or commercial support.

Why do SSL certificates expire?

Limited lifetimes limit the damage from compromised or misissued certificates and keep validation fresh. Lifetimes are shrinking industry wide, 200 days maximum since March 2026, heading to 47 days by 2029, which is why renewal must be automated.

How do I know if my SSL certificate is working?

Load the site with https://, open the browser's site information panel, confirm the connection is reported secure and view the certificate's coverage and expiry. Then check the HTTP version redirects and key pages show no mixed content warnings.

What does not secure mean in the browser?

The connection to that page is not protected, usually because it is being served over HTTP or the certificate is invalid. It describes the connection, not necessarily the business.

What happened to the padlock icon?

Chrome replaced it with a neutral settings style icon in 2023 because research showed most people wrongly read the padlock as a trust badge for the website itself. Check the site information panel instead.

Does HTTPS improve Google rankings?

It is a lightweight positive signal and Google prefers indexing HTTPS versions, but it is a foundation, not a growth strategy. Content and relevance do the ranking work.

What is mixed content?

An HTTPS page loading some resources over plain HTTP. Browsers restrict or block it because it undermines the secure connection. The fix is updating those resources to HTTPS.

Can a website with HTTPS still be dangerous?

Absolutely. HTTPS verifies and encrypts the connection; it says nothing about who runs the site. Phishing sites routinely use valid certificates.

Will SSL slow down my website?

Not meaningfully. Modern TLS is designed for performance and real speed problems live in images, scripts, hosting and themes.

Who provides the SSL certificate, my host or my developer?

Usually the hosting provider issues and renews it automatically; the developer's job is configuring the site correctly around it: redirects, canonicals, assets and testing.

How much should SSL cost for a small business website?

Often nothing beyond hosting, because automated free certificates are the modern default. Paid products are legitimate when you need what they specifically provide, so ask what that is before paying.

What happens if my SSL certificate expires?

Browsers show connection warnings instead of your website and most visitors leave. Automated renewal with failure alerts is the fix and shrinking lifetimes make it mandatory.

Do I need a wildcard SSL certificate?

Only if you run multiple subdomains that need coverage under one certificate. For a standard business website, your host's default arrangement is almost always right.

Is HTTPS the same as having a secure website?

No. HTTPS secures data in transit. A secure website also needs updated software, access control, backups, secure hosting and monitoring. The certificate is one layer of that stack.

Next steps: pick your path

Path 1: check your own site today. Run the seven step check from this article: HTTPS loads, HTTP redirects, both hostnames work, the connection panel reports secure, the certificate is valid and covered, key pages are clean, no mixed content. Ten minutes and you will know whether you have a solved problem or a quiet one.

Path 2: something failed the check. Start with your hosting provider, because certificate issuance and renewal are usually theirs to fix, then work the redirect, canonical and mixed content items with whoever maintains the site. If nobody currently maintains it, that is the actual finding and the technical foundations a business website stands on covers what a properly looked after site includes beyond the certificate.

Path 3: you would rather never think about this again. Correct instinct, that is the whole point of the article. Ask us to look over your HTTPS setup and we will tell you plainly whether it is configured properly, what needs fixing and whether anything on the invoice is paying for a problem that stopped existing years ago.

Sources and further reading

Chromium blog: an update on the lock icon , why Chrome retired the padlock in Chrome 117 and what replaced it.

CA/Browser Forum: ballot SC-081v3 , the industry schedule reducing maximum certificate lifetimes to 200, 100 and eventually 47 days.

Let's Encrypt: FAQ , free domain validation certificates, 90 day defaults and what the nonprofit does and does not offer.

Let's Encrypt: from 90 to 45 days , the announcement that its certificate lifetimes will halve by 2028 under the industry requirements.

web.dev: why HTTPS matters , Google's case for HTTPS on every website, including integrity, privacy and modern browser features.

Google Search Central: HTTPS as a ranking signal , the original announcement describing HTTPS as a lightweight signal in Google's systems.

General information only. Rules vary by situation, particularly around advertising claims, privacy, reviews and consumer law. If you're unsure about compliance, get professional advice.