On this page
An SSL certificate is a small data file on your web server that lets browsers connect to your website over an encrypted link. It’s what turns http:// into https:// and what stops Chrome from labelling your site “Not secure”. Yes, your website needs one, even if it’s a single page with a phone number. The good news is that for a normal small business site it should cost you nothing.
What does the padlock and https mean?
When a site has a valid certificate, the address starts with https:// and the browser shows a sign that the connection is secure. For years that sign was a padlock. Recent versions of Chrome swapped the padlock for a small icon that opens the site’s settings, while other browsers still show one. Either way, clicking it will tell you the connection is secure and who issued the certificate.
The “s” in https stands for secure. It means two things are true:
- The browser has checked that the server it’s talking to really is the one for that domain, not an impostor.
- Everything passed between the visitor and the server is scrambled so nobody in between can read or alter it.
You’ll also hear the term TLS. That’s the modern name for the technology. SSL is the older version and is no longer used, but the name stuck, so hosts and browsers still say “SSL certificate”.
What does an SSL certificate protect?
It protects information while it travels. Picture a customer filling in your contact form on café wi-fi in Ludlow. Without https, the name, phone number and message go across that network as plain text. Anyone on the same network with the right tools could read them. With https, they’d see scrambled data.
It covers:
- contact and booking forms
- logins, including your own WordPress login
- anything typed into a checkout
- the pages someone visits on your site, which stay private from others on the same network (though not the domain name itself)
It also stops someone in the middle from injecting adverts or changing what your page says on the way to the visitor.
Why does Chrome say “Not secure”?
Chrome, and most other browsers, label any page loaded over plain http as “Not secure” in the address bar. They’ve done this for several years. The warning can look worse when a visitor starts typing into a form.
A plumber in Shrewsbury doesn’t need customers wondering whether his site has been hacked. The words “Not secure” next to his name do exactly that, even though nothing is wrong with his business. That alone is reason enough to have a certificate.
Google has also said that https is a small factor in how it ranks pages. It won’t lift a weak page to the top, but there’s no reason to give it away.
If you see “Not secure” on your own site even though you have a certificate, skip down to the sections on mixed content and forcing https.
Free vs paid SSL certificates
Every certificate encrypts traffic to the same standard. A free one doesn’t give weaker encryption than a paid one. The difference is how much checking the issuer does before handing it over.
Domain Validated (DV)
The issuer confirms that you control the domain, usually automatically, and that’s all. Let’s Encrypt, the free certificate authority, issues DV certificates. This is what almost every small business website uses and all it needs.
Organisation Validated (OV)
The issuer also checks that your business exists, for example against Companies House records. The company name goes inside the certificate, where a curious visitor could find it by clicking through. Most visitors never look. These cost money and take longer to issue.
Extended Validation (EV)
A stricter version of the same business check. Years ago browsers showed the company name in green in the address bar for EV certificates. They stopped, so to a visitor an EV site now looks the same as any other https site. It’s hard to justify for a small firm.
So which do you need?
A free DV certificate. If you’re being sold a paid certificate for a brochure site, a booking form or a small shop, ask what you’d get that you don’t get for free. Large organisations and some regulated industries have their own reasons to buy OV certificates. A sole trader doesn’t.
Free SSL on our hosting (AutoSSL)
All our hosting plans include free Let’s Encrypt certificates. A cPanel tool called AutoSSL looks at each domain on your account, requests a certificate once the domain points at our server and fits it for you. You don’t fill in anything or copy any codes.
If you’ve just moved a domain to us it can take a little while to appear, because AutoSSL has to see the domain pointing at our server first. You can check, or run AutoSSL straight away, from SSL/TLS Status in cPanel. Our guide on how to install a free SSL certificate shows each click.
Do SSL certificates need renewing?
Yes. Every certificate has an expiry date, and Let’s Encrypt ones last only a few months. Paid certificates must now be renewed more often than they used to as well, because the industry has been shortening the maximum lifetime.
On hosting with AutoSSL, renewal happens on its own well before the expiry date. You only need to step in if something stops it, and the usual cause is a domain that no longer points at the server. For example, if you moved your website to Squarespace but left a subdomain pointing at old hosting, that subdomain’s certificate won’t renew there.
When a certificate does expire, browsers show a full-page warning that most visitors won’t click past. If you ever see one on your own site, check where the domain points first. Our DNS checker shows that in seconds.
What is mixed content?
Mixed content is when the page itself loads over https, but some pieces of it, usually images or scripts, are still pulled in from http:// addresses. The browser may then drop the secure sign or block those pieces, so images go missing.
It’s common on older WordPress sites that were set up before the certificate existed. Every image in every post was saved with an http:// link. Updating the site address and swapping those old links to https usually fixes it. The steps are in how to force https on your website.
How to force https
Having a certificate isn’t quite enough. If someone types your address without https, or follows an old link, they can still land on the insecure version. Forcing https means the server automatically sends every http visitor to the https version.
On our hosting you can do this with a single switch in cPanel, a few lines in your .htaccess file, or your WordPress settings. Pick one method, not all three, or you can end up with a redirect loop. Follow how to force https on your website, and if you hit an endless loop, see how to fix too many redirects.
What SSL doesn’t do
This is where people get caught out. The padlock means the connection is private. It doesn’t say the website is safe, honest or free of malware.
An SSL certificate won’t:
- stop your site being hacked through an old plugin or a weak password
- remove malware already on the site
- protect your email from spam or phishing
- prove a site is trustworthy (scam sites get free certificates too)
- back up your website
For WordPress sites, keep everything updated and use strong passwords. Our guides on how to secure WordPress and how to scan your site for malware cover the basics.
Common questions
Does a website without a shop or login need SSL?
Yes. Browsers mark every http page “Not secure” whatever is on it, and any contact form sends personal details. There’s no sensible reason to skip it when it’s free.
Will adding SSL break my website?
Usually not. The most common problems are mixed content (missing images) and redirect loops from setting up more than one redirect. Both can be fixed with the guides above.
Does SSL cover www and non-www?
They’re separate names, so the certificate needs to include both. AutoSSL covers both as long as both point at our server. You can see which names are covered under SSL/TLS Status in cPanel.
Do I need a separate certificate for each domain?
Each domain and subdomain needs to be covered, but on our hosting AutoSSL handles every domain on your account for free. You don’t buy them one at a time.
Getting it sorted
If your current site still shows “Not secure”, or your host charges for certificates, it’s worth fixing. Our web hosting and WordPress hosting include free SSL that renews on its own, from £2.99 and £3.99 a month, and we’ll move your site across for free.