SSL is the difference between a padlock and a browser warning telling visitors your site is not secure. It is cheap, usually free, and still missing or misconfigured on a surprising number of business sites.
An SSL certificate encrypts traffic between your site and its visitors and enables https. Every site needs one, including sites that take no payments, because browsers now warn on any page without it. A free certificate from Let's Encrypt is sufficient for the vast majority of businesses, and most hosting provides one automatically.
What it actually does
It encrypts data in transit so anyone intercepting it sees noise rather than content, and it verifies that the server is the one it claims to be.
The visible effect is https and the padlock. The invisible effect is that browsers stop labelling your site Not Secure, which they do on any page collecting input over plain http.
Which type you need
| Type | Verifies | Cost | Suits |
|---|---|---|---|
| Domain Validation | You control the domain | Free | Almost every business site |
| Organisation Validation | Your organisation exists | Moderate | Firms wanting the extra check |
| Extended Validation | Extensive legal checks | High | Rarely worth it now |
| Wildcard | One certificate for all subdomains | Varies | Sites with many subdomains |
Extended Validation used to display a green company name in the address bar. Browsers removed that treatment years ago, which removed most of the reason to buy it. Domain Validation is what most sites should use.
Installing and switching
- Check whether your host provides one automatically. Most now do, via Let's Encrypt.
- Install and confirm https loads.
- Redirect all http traffic to https at the server level, permanently.
- Update internal links, canonical tags and the sitemap to https.
- Add the https version as a property in Search Console.
- Check for mixed content warnings and fix them.
Mixed content
After switching, a page served over https that loads an image, script or stylesheet over http is mixed content. Browsers block or warn on it, and the padlock disappears even though the certificate is fine.
Fix it by updating those references to https or to protocol-relative paths. It is usually hard-coded image URLs in old content, and a database search and replace handles most of it.
Frequently asked questions
Do I need SSL if I do not take payments?
Yes. Browsers mark any site without https as Not Secure, which visitors see and react to. It is also a lightweight ranking signal and a requirement for many modern browser features. There is no reason to skip it now it is free.
Are free SSL certificates as good as paid ones?
For encryption, identical. A free Let's Encrypt certificate provides the same protection as a paid Domain Validation certificate. Paid options add organisation verification and support, which most small businesses do not need.
Does SSL affect SEO?
Yes, mildly. Google confirmed https as a lightweight ranking signal years ago. The larger effect is behavioural: visitors leave when a browser warns them a site is not secure, and that shows up in your metrics long before rankings do.
Why does my padlock not show even with SSL installed?
Almost always mixed content: something on the page loads over http. Open the browser console and it will name the offending resource. Update those URLs to https and the padlock returns.
How often do certificates need renewing?
Let's Encrypt certificates last 90 days and renew automatically when configured properly. Paid certificates typically run a year. Expired certificates cause a full browser block, so automatic renewal with monitoring is worth setting up.