Look at the address bar on most websites and you will see a small padlock, or at least no warning. That quiet signal comes from HTTPS, made possible by an SSL certificate. Without it, browsers label your site "Not secure", which is hardly the first impression you want for a business. The good news: it is simpler and more affordable than ever to set up properly.
What HTTPS actually does
When someone visits your website, their browser and your server exchange information: pages, form entries, login details, payment data. With plain HTTP, that information travels as readable text that anyone in between could, in principle, intercept or alter. Think of an open postcard passing through many hands.
HTTPS wraps that conversation in encryption. It is more like a sealed envelope that only the sender and recipient can open. It also helps prove that the visitor is talking to your real server and not an impostor, and it prevents content from being tampered with along the way, such as injected adverts on public Wi-Fi.
Where the certificate fits in
An SSL certificate, more accurately called a TLS certificate today, is a small digital file installed on your server. It is issued by a trusted certificate authority and confirms that a particular domain is controlled by whoever installed it. Browsers check it every time someone connects. If it is valid, the padlock appears. If it is expired, mismatched or missing, visitors see a warning.
Types of certificates
You will come across three validation levels:
- Domain Validated (DV): confirms control of the domain. Quick, often free, and suitable for most business websites
- Organisation Validated (OV): adds checks that your organisation exists
- Extended Validation (EV): involves deeper checks, though modern browsers no longer display it very differently
You will also see options covering a single domain, several named domains or a wildcard covering all subdomains of one domain.
For the vast majority of small and medium businesses, a free DV certificate from a service such as Let's Encrypt, usually set up automatically by the host, is perfectly adequate. The encryption strength is the same.
Why it matters for your business
- Trust: browser warnings scare visitors away, especially on contact and checkout pages
- Security: logins and form data are protected in transit
- Requirements: payment providers and many modern browser features require HTTPS
- Search: Google has confirmed HTTPS as a ranking signal, and Chrome flags insecure pages clearly
Common mistakes to avoid
Expired certificates
Certificates have a limited lifespan and must be renewed. Automatic renewal prevents the embarrassing day when your site suddenly shows a full-screen warning. Confirm that renewal is automated and that someone gets alerted if it fails.
Mixed content
If an HTTPS page loads images, scripts or fonts over plain HTTP, browsers may block them or remove the padlock. Update internal links and embedded resources to HTTPS after switching.
No redirect from HTTP
Visitors and old links might still use the HTTP address. Set up a permanent redirect so every HTTP request goes to the HTTPS version, and make sure your canonical tags and sitemap use HTTPS too.
Forgetting subdomains
Your main site may be secure while a booking page, shop or staging site on a subdomain is not. Check every address you use.
A word on what HTTPS does not do
HTTPS protects data on its journey. It does not stop someone hacking your server, guessing weak passwords or exploiting an outdated plugin. The padlock means the connection is secure, not that the site itself is safe. It is one essential layer among several.
FAQ
Do I need HTTPS if my site has no forms or payments?
Yes. Browsers flag all HTTP pages, visitors expect the padlock and search engines favour secure sites. There is no good reason to skip it.
Can switching to HTTPS hurt my SEO?
Done properly, with permanent redirects and updated internal links, it should not. Problems arise when redirects are missing or misconfigured.
Is a paid certificate more secure than a free one?
The encryption is the same. Paid certificates may add organisation checks, support or warranties, which some businesses value.
Next step
Certificate setup, renewals and redirects are included in our cloud hosting and web development work. If your site shows a warning or you are unsure it is configured correctly, ask us to check it.