What is an SSL certificate and why your site needs one

Open your own website right now and look at the address bar. If it doesn’t say https:// with a little padlock, you’ve got a problem that’s costing you customers, and you probably can’t even see it happening.

An SSL certificate is a small data file that encrypts the connection between a visitor’s browser and your website, so what they send you (passwords, card details, contact form messages) can’t be read by anyone sitting in between. It’s the thing that turns http:// into https:// and puts the padlock in the bar. Without it, Chrome and Safari label your site “Not Secure”, and that two-word warning alone sends people running.

What it’s actually doing

With no SSL, data travels between the visitor and your site as plain text. Anyone on the same network, the coffee-shop wifi, a dodgy router, can potentially read it. SSL scrambles that data so only your server can unscramble it on the other end.

Quick terminology note so it doesn’t trip you up: “SSL” technically refers to an older protocol that’s since been replaced by TLS, but the name stuck. When anyone says “SSL certificate” they mean the file that enables HTTPS. You don’t need to care about the difference to use one.

Why your site genuinely needs it

Three reasons, in the order they actually affect a small business:

1. Trust. A “Not Secure” label makes you look amateur at best, dodgy at worst. Almost nobody types their email into a form that’s throwing a warning.
2. Data protection. Any site with a contact form, login, booking or payment is handling personal data, and keeping that private in transit is effectively expected under GDPR.
3. Search. Google treats HTTPS as a ranking signal and AI tools lean toward credible, well-built sites. Having it won’t guarantee a higher spot, but not having it is a quiet handicap.

If your site collects any information at all, even just a contact form, this isn’t optional. It’s the floor that browsers and customers now expect you to clear.

What it does, and what it absolutely doesn’t

This is where people get a false sense of security. SSL is one layer, not a force field.

The padlock means the connection is encrypted. It says nothing about whether the website behind it is well looked after. You still need updates, strong passwords and backups, that’s all in the website security checklist.

Getting one (it’s easier than it sounds)

The heavy lifting happens at the hosting level, so this is mostly a matter of flicking the right switches.

Worth knowing: the most common SSL problem isn’t a missing certificate, it’s an expired or misconfigured one. A cert that lapsed last week produces the exact same alarming warning as having none at all, so renewal is the bit that actually keeps you safe long-term.

If you’d rather not think about it

Certificates, renewals and redirects are the sort of background plumbing that’s easy to forget until it breaks. Every site we build and host ships with SSL installed, HTTPS forced and renewal handled automatically, so the padlock just stays put. You can see what’s included on our pricing page, or get in touch and we’ll check your current site for you.

Where your site lives matters here too, because the host is what makes free, automatic SSL painless in the first place, our guide on what web hosting actually is explains how the two fit together.

Simplest next step is the one from the top: look at your address bar. No HTTPS, no padlock? That’s the first thing to fix this week.