What an SSL certificate is, in plain words
When someone opens your site, their browser and the server your site lives on exchange data: the pages, but also what the visitor types into a contact form, a password or booking details. The SSL certificate does two things: it encrypts that data, so nobody along the way can read it, and it proves the site really is what it claims to be.
The correct technical name today is TLS, but everyone still calls it SSL: it's the same thing. You recognise it by the address starting with https:// instead of http:// and by the padlock in the browser bar.
Why you need it even if you don't sell online
People often think the certificate is only for those taking payments. It isn't: a contact form is enough to collect personal data, and browsers treat sites without https badly anyway.
- The browser warns visitors: a site without https is flagged as "Not secure" next to the address. For a first-time visitor that's a very good reason to close the page.
- It protects your customers' data: name, email and phone typed into a form travel encrypted. The GDPR asks for adequate measures to protect the personal data you collect, and an encrypted connection is the bare minimum.
- It matters to Google: Google has stated that https is one of the signals it considers. It won't push you up on its own, but a site without a certificate starts at a disadvantage. We cover this in why my site can't be found on Google too.
- Some features won't run without https: online payments, geolocation, notifications and installing the site on the phone like an app all require a secure connection.
How much an SSL certificate costs
For the vast majority of sites the certificate is free: it's issued by authorities trusted by every browser, and most web hosting providers switch it on and renew it by themselves. There are paid certificates too, which check more thoroughly who is behind the site: they don't encrypt any better, only the identity check changes.
| Type | What it checks | Who it's for |
|---|---|---|
| Free, domain validated | That the site really controls that domain | Brochure sites, booking sites, blogs, most online shops |
| Paid, organisation validated | That the company exists too, with document checks | Companies whose internal or industry rules require it |
What happens if the certificate expires
The certificate doesn't last forever: it's valid for a few months and must be renewed. The maximum allowed duration is getting shorter, which is why what matters most today is that renewal is automatic. If renewal fails, the day after expiry browsers show a warning page such as "Your connection is not private": hardly anyone clicks through.
Why renewal can fail
- The certificate was installed by hand and nobody remembered to renew it.
- The domain was moved or its settings changed, and the server can no longer prove it controls it.
- The site was moved to another host without switching the certificate back on.
How to check your site's certificate
- Open the site and look at the address: it must start with https:// and show the padlock, with no warnings.
- Click the padlock: the browser tells you whether the connection is secure and, in the certificate details, until when it's valid.
- Try the version without https: type the address with http:// and check that it takes you to the https version on its own.
- Check the version with and without www too: both must open with no warnings.
- Look for a crossed-out padlock or a "not secure content" warning: it happens when an https page still loads images or scripts over http. It needs fixing, because the browser may block them.
Frequently asked questions
01Is an SSL certificate mandatory?+
No law names it explicitly, but the GDPR asks for adequate measures to protect the personal data you collect, for example through a contact form. In practice it's essential today: without it, browsers flag the site as not secure.
02Are SSL and TLS the same thing?+
Yes, for anyone running a website they're the same thing. TLS is the modern version of the technology, but the name SSL stuck in everyday use.
03How long does an SSL certificate last?+
A few months: free certificates usually last 90 days and renew themselves, and paid ones too have a maximum duration that is getting shorter. That's why renewal should be automatic and monitored.
04Does an SSL certificate push the site up on Google?+
Not on its own. Google counts https among its signals, but it matters far more that your pages answer what people are searching for. Without a certificate, though, you start at a disadvantage and lose visitors' trust.
05My site shows "Not secure": what should I do?+
Check in your hosting panel whether the certificate is active and renewed, then make sure the http version leads to the https one and that pages don't load images over http. If you don't have the logins or don't know where to start, we can do it for you.
