Do I need an SSL certificate?
4 min read · Updated
Short answer: yes. Every website needs one, even if you don’t sell anything online. The good news is it’s usually free and takes a few minutes to switch on.
What SSL and HTTPS actually are
An SSL certificate (technically TLS these days, but everyone still says SSL) lets your website use HTTPS, a secure connection between your site and your visitor’s browser. Anything sent over it, like a contact form, a login or a card number, is encrypted so nobody in between can read it.
You can tell a site uses HTTPS because its address starts with https:// and the browser shows a padlock.
Why you need it, even without an online shop
- Browsers warn people off sites without it. Chrome, Safari and others label sites without HTTPS as “Not secure”, right next to your address. For a potential customer, that’s alarming, especially on a page with a contact form.
- Your contact forms send personal details. Names, emails, phone numbers and messages deserve protection.
- Google prefers secure sites. HTTPS is a small ranking signal.
- Some features need it. Modern browser features, like location for “find a store near me”, only work over HTTPS.
How to get one
Most hosting companies now include a free certificate:
- Website builders like Squarespace, Wix and Shopify include SSL automatically. It’s usually already on.
- WordPress hosts almost all offer free Let’s Encrypt certificates. Look for “SSL” or “Security” in your hosting control panel and switch it on.
- If your host charges for it, it may be worth asking why, or moving to one that doesn’t.
Three things to check after switching it on
1. Redirect the insecure version
Your site should automatically send anyone who visits http:// to https://. Otherwise people typing your address, or following old links, can still land on the insecure version. Most hosts have a “force HTTPS” setting.
2. Fix mixed content
If your page is HTTPS but loads some images or scripts over plain HTTP, browsers may block them or remove the padlock. This usually happens with images added before the switch. Updating those links to https:// fixes it, and plugins can do it in bulk on WordPress.
3. Make sure it renews
Certificates expire, often every 90 days for free ones. Most hosts renew them automatically, but if renewal fails, visitors see a full-page warning saying your site may be unsafe, and almost all of them leave. Check auto-renewal is switched on, and keep an eye on the expiry date.
Beyond the padlock
HTTPS protects the connection, not the whole site. Keeping your website software and plugins up to date, using strong passwords and two-factor login, and having backups all matter too. There are also security headers, settings that tell browsers how to protect your visitors from common attacks. Your web developer or host can add them.
Check your site
A free scan checks HTTPS, your certificate’s expiry date, whether the insecure version redirects, mixed content and security headers, and explains each result in plain English. Read more about the security check, or see WCAG basics for small business for another often-overlooked area.
Want the full picture? See what our free security audit checks
Common questions
Is an SSL certificate expensive?
Usually not. Most hosts include a free certificate from Let's Encrypt and renew it automatically. Paid certificates exist, but a small business rarely needs one.
What's the difference between SSL and TLS?
TLS is the modern version of SSL. People still say "SSL certificate" out of habit, but they mean the same thing.
My site shows a padlock. Am I fully secure?
The padlock means the connection is encrypted. It doesn't mean the site is free of other problems like outdated plugins or weak passwords. It's the starting point, not the whole story.