In plain terms
When a browser talks to a website without SSL, the conversation is a postcard: anyone handling it along the way can read it or change it. With SSL it is a sealed letter: the browser and the server agree a key nobody else has, and everything sent is encrypted with it. The certificate is the server proving to the browser that it is who it says it is, issued by an authority the browser already trusts.
You see it as the padlock, and as https:// rather than http:// at the start of the address. It is a common question, and advertisers pay to answer it, because the people asking are about to buy hosting.
Why every website needs it now
- Browsers say “Not secure”. Since 2018 Chrome has labelled every HTTP page that way in the address bar, next to your name. Visitors read it as a warning about your business, which for a stranger deciding whether to enquire it effectively is.
- Google prefers it. HTTPS has been a ranking signal since 2014. It is a small one, but it is one you can have for nothing.
- Forms need it. A contact form, a login or a checkout on an HTTP page sends the customer’s name, email, phone number or card details unencrypted. Under UK GDPR that is a security failure you chose.
- Modern browser features require it. Location, payment requests, service workers and much of what makes a site feel like an app only work over HTTPS.
- Trust. A padlock does not make a business honest, but its absence makes a visitor wonder, and the two human queries this domain received in sixteen months were both people wondering.
It should be free
Let’s Encrypt, a non-profit certificate authority, has issued free certificates since 2016, and by its own count secures hundreds of millions of websites. Every reputable host installs one automatically and renews it every ninety days without anyone noticing. Our hosting and care includes it; there is no line for it on the invoice because it costs us nothing either.
| Kind | What it proves | Cost | Who needs it |
|---|---|---|---|
| Domain-validated (Let’s Encrypt and similar) | The server controls the domain | Free | Almost every business website, including shops using a hosted payment page |
| Organisation-validated | The domain and that the organisation exists | Tens to hundreds of pounds a year | Rarely worth it; the browser shows the same padlock |
| Extended validation | Detailed vetting of the organisation | Hundreds a year | Banks and the like; browsers stopped showing the green company name in 2019, removing most of the point |
| Wildcard | One certificate for all subdomains | Free from Let’s Encrypt with DNS validation | Sites with many subdomains |
Source: Let’s Encrypt documentation; browser vendor announcements on EV indicators (Chrome and Firefox, 2019). Paid certificate prices are published by their vendors.
A host that charges £50 or more a year for “SSL” on a small business site is selling a free thing. It is a useful tell about the rest of their pricing.
How to check yours, and fix it
- Load your site. Look for the padlock and https:// in the address bar. Click the padlock: it shows the certificate and its expiry.
- Type the http:// version of your address. It should redirect to https:// automatically. If both versions load separately, Google sees two sites and you have a duplicate-content problem as well as a security one.
- Look for a “mixed content” warning: an HTTPS page loading an image or script over HTTP. The padlock breaks. Usually an old image link in the content; a find-and-replace fixes it.
- In Search Console, the HTTPS report lists any pages still served over HTTP. This site’s export on 28 August 2026 showed 0 of 13; that is the target.
- If there is no certificate, log in to your hosting and turn on the free one. If your host does not offer one, that is the reason to move host, not to pay them.
What SSL does not do
It protects data in transit. It does not make the website itself secure: an out-of-date WordPress with a vulnerable plugin is just as hackable with a padlock as without. Nor does it prove the business is honest; a scam site can have a perfectly valid free certificate, which is why the padlock is a floor, not a recommendation. The guide on keeping a site secure covers the rest.
