That little padlock in your browser’s address bar? That’s SSL. And without it, your website looks unsafe, ranks lower on Google, and scares visitors away.
In 2026, a website without HTTPS is not just insecure — it’s unprofessional.
This beginner guide explains SSL certificates in plain language: what they do, which type you need, how to get one for free, and how to set it up on any website (especially WordPress) without breaking anything.
Quick answer: what is an SSL certificate?
| Question | Answer |
|---|---|
| What is SSL? | SSL (Secure Sockets Layer — now technically TLS) is encryption that protects data between a visitor’s browser and your website’s server. |
| What does it do? | Encrypts form submissions, logins, and all page content so hackers can’t read or tamper with it. Also verifies your website is really yours. |
| How do you know it’s working? | Browser shows https:// and a padlock icon. Without SSL, browsers show “Not Secure” warning. |
| Do you need it? | Yes — every website needs SSL, even if you don’t take payments. Google ranks HTTPS sites higher and browsers warn visitors away from HTTP. |
| How much does it cost? | $0 for most business sites (free Let’s Encrypt). Paid SSL ($10-300/yr) adds warranty, support, or organization validation. |
Why SSL matters for your business (not just tech)
1. Visitors trust you
| Without SSL (HTTP) | With SSL (HTTPS) |
|---|---|
| Browser shows “Not Secure” warning | Browser shows padlock — visitors feel safe |
| Visitors hesitate to fill forms | Forms feel safe to submit |
| Higher bounce rate | Lower bounce rate, more conversions |
Google Chrome, Firefox, and Safari all flag HTTP sites as “Not Secure” since 2018.
2. Google ranks HTTPS higher
- HTTPS is a confirmed Google ranking signal (since 2014)
- Chrome’s “Not Secure” label hurts click-through from search results
- HTTPS is required for HTTP/2 and HTTP/3 — faster loading protocols
3. You handle sensitive data (even if you think you don’t)
Even a simple contact form collects:
- Names, emails, phone numbers
- Messages that may contain private details
- Login credentials (if you have admin or membership)
Without SSL, that data travels as readable text — anyone on the same Wi-Fi can intercept it.
4. Required for modern web features
Many browser features only work on HTTPS:
- Geolocation, push notifications, camera/microphone access
- Progressive Web App (PWA) installation
- Payment Request API (Apple Pay, Google Pay)
How SSL works (simple version)
Visitor's Browser ←—encrypted connection—→ Your Website Server
| |
├── Visitor requests https://yoursite.com |
|── Server sends SSL certificate ─────────────→|
| (proves identity + contains public key) |
├── Browser verifies certificate ──────────────→|
| (checks expiry, domain, trusted issuer) |
├── Browser + server negotiate encryption ─────→|
└── All data now encrypted (HTTPS) ←──────────┘In plain English:
- Your server proves it really is
yoursite.com(certificate) - Browser and server agree on a secret encryption method
- All data between them is scrambled — only they can read it
Analogy: SSL is like a sealed, tamper-proof envelope for every letter between your customer and your business, instead of a postcard anyone can read.
Types of SSL certificates
By validation level
| Type | What It Verifies | How Long to Get | Browser Shows | Cost | Best For |
|---|---|---|---|---|---|
| DV (Domain Validated) | You control the domain | Minutes (automated) | Padlock + https:// | Free (Let’s Encrypt) or $10/yr | 99% of small business sites, blogs, portfolios |
| OV (Organization Validated) | Domain + business identity | 1-3 days (business docs checked) | Padlock + https:// (org details in cert) | $50-200/yr | Businesses wanting verified identity, B2B |
| EV (Extended Validation) | Strictest business vetting | 1-5 days (legal, physical, operational checks) | Padlock + https:// (no more green bar since 2019) | $150-300/yr | Banks, large ecommerce, enterprises |
For most small businesses: DV (free) is sufficient. OV/EV add identity verification but browsers no longer show a distinctive green bar — the padlock looks the same.
By domain coverage
| Coverage | What It Covers | Example | Cost |
|---|---|---|---|
| Single-domain | One exact domain | yoursite.com + www.yoursite.com (usually included) |
Free - $10/yr |
| Wildcard | Domain + all subdomains | *.yoursite.com covers blog.yoursite.com, shop.yoursite.com, etc. |
Free (Let’s Encrypt wildcard) or $50-150/yr |
| Multi-domain (SAN/UCC) | Up to 100 domains | yoursite.com + yoursite.net + otherbrand.com |
$30-200/yr |
Most business sites: Single-domain DV covers yoursite.com + www.yoursite.com — that’s all you need. Use wildcard if you run many subdomains.
Free SSL vs paid SSL
| Feature | Free SSL (Let’s Encrypt) | Paid SSL (DigiCert, Sectigo, GlobalSign) |
|---|---|---|
| Encryption strength | Same (256-bit) | Same (256-bit) |
| Browser trust | Same padlock, same https:// | Same padlock, same https:// |
| Validation | DV only (domain control) | DV, OV, EV |
| Validity period | 90 days (auto-renew) | 1 year (must renew annually) |
| Warranty | None | $10K - $1.75M (pays if cert fails due to issuer fault) |
| Support | Community / host support | Dedicated support from issuer |
| Wildcard | Yes (via DNS validation) | Yes |
| Best for | Most small businesses, blogs, portfolios, small stores | Enterprises needing OV/EV, warranty, or dedicated support |
Bottom line: For 95% of business websites, free Let’s Encrypt DV is the right choice. Paid SSL makes sense only if you need OV/EV validation, a warranty for compliance, or your host doesn’t support Let’s Encrypt (rare in 2026).
How to get and install SSL (step-by-step)
Option 1: One-click free SSL via your hosting provider (recommended)
Most modern hosts offer one-click Let’s Encrypt — no manual steps.
| Host | Where to Enable | Steps |
|---|---|---|
| Hostinger | hPanel → Security → SSL → Free SSL | Select domain → Install → Auto-renew ON |
| SiteGround | Site Tools → Security → SSL Manager | Select domain → Get → Let’s Encrypt |
| Cloudways | Application → SSL Certificate | Let’s Encrypt → Install |
| Kinsta | MyKinsta → Domains → Add domain → Free SSL | Auto-provisioned |
| Namecheap | cPanel → SSL/TLS Status → Run AutoSSL | One click |
After enabling:
- Wait 2-5 minutes for provisioning
- Test: visit
https://yoursite.com— padlock should appear - Enable “Force HTTPS” toggle if your host offers it (otherwise do Step 2 below)
That’s it for most sites — you’re done after the next step.
Step 2: Force all traffic to HTTPS (critical)
Without this, both http://yoursite.com and https://yoursite.com work — creating duplicate content and leaving some visitors on insecure HTTP.
For WordPress (easiest)
Method A — Plugin (no code):
- Install Really Simple SSL (free, 5M+ installs)
- Activate → it detects SSL → click “Go ahead, activate SSL!”
- It handles HTTPS redirect, mixed content fixes, and HSTS
Method B — Manual (if you prefer no extra plugin):
- WordPress → Settings → General → change both URLs to
https://:- WordPress Address (URL):
https://yoursite.com - Site Address (URL):
https://yoursite.com
- WordPress Address (URL):
- Add to
.htaccess(Apache) at the top:
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L=301,R=301]- For Nginx, add to server block:
if ($scheme != "https") {
return 301 https://$host$request_uri;
}For non-WordPress sites
- Webflow / Wix / Squarespace / Shopify: SSL is automatic — enable “Force HTTPS” in site settings
- Custom / Next.js / Astro: Set redirect at hosting/CDN level (Vercel, Netlify, Cloudflare all have “Always Use HTTPS” toggle)
Step 3: Fix mixed content (if padlock shows warning)
Mixed content = HTTPS page loading HTTP resources (images, scripts). Browsers block or warn.
How to detect:
- Browser → visit
https://yoursite.com→ Right-click → Inspect → Console → look for “Mixed Content” warnings - Or use Why No Padlock — enter URL, it lists insecure items
Common fixes:
| Mixed Content Source | Fix |
|---|---|
Hardcoded http:// image URLs in content |
Search-replace http://yoursite.com → https://yoursite.com (use Better Search Replace plugin) |
| Theme / plugin loading HTTP assets | Update theme/plugins; or Really Simple SSL fixes automatically |
| CDN URL still HTTP | Update CDN URL to https:// in plugin/host settings |
| External embed (YouTube, Google Fonts) | Change embed URL to https:// |
Step 4: Update Google and external services
- Google Search Console: Add
https://property (or domain property covers both) - Google Analytics 4: Ensure property uses
https://URL - Sitemap: Submit
https://yoursite.com/sitemap.xmlto GSC - Social profiles: Update website link to
https:// - Email signatures, business listings: Update to
https:// - 301 redirects: Verify
http://→https://returns 301 (use httpstatus.io)
How to check if SSL is working correctly
| Check | Tool | What to Look For |
|---|---|---|
| Padlock in browser | Visit https://yoursite.com |
Padlock without warning or triangle |
| SSL grade | SSL Labs Server Test | Grade A or A+ |
| Mixed content | Why No Padlock | “All items called securely” |
| Redirect test | httpstatus.io → check http://yoursite.com |
Returns 301 to https:// |
| Expiry monitoring | Hosting panel or UptimeRobot | Auto-renewal ON, expiry > 30 days away |
| Search Console | GSC → Pages → Index | HTTPS URLs indexed, no HTTP duplicates |
Common SSL errors and how to fix them
| Error Visitors See | Cause | Fix |
|---|---|---|
| “Your connection is not private” / NET::ERR_CERT_DATE_INVALID | Certificate expired | Renew SSL (host panel → SSL → Renew) or enable auto-renew; Let’s Encrypt renews every 90 days |
| “NET::ERR_CERT_COMMON_NAME_INVALID” | Domain mismatch — cert for yoursite.com but visitor on www.yoursite.com without SAN |
Reissue cert covering both yoursite.com + www.yoursite.com (most hosts do this automatically) |
| “Mixed content” warning / broken padlock | HTTPS page loads HTTP images/scripts | Fix mixed content (see Step 3 above) |
| “Too many redirects” / ERR_TOO_MANY_REDIRECTS | Redirect loop — both plugin and .htaccess redirecting, or Cloudflare SSL mode wrong |
Set Cloudflare SSL to Full (Strict) if origin has valid cert; disable one redirect source |
| SSL works on homepage but not inner pages | Hardcoded HTTP links in content/database | Run Better Search Replace: http://yoursite.com → https://yoursite.com |
| “NET::ERR_CERT_AUTHORITY_INVALID” | Self-signed or untrusted issuer | Use Let’s Encrypt or trusted CA; don’t use self-signed on live site |
SSL renewal: set it and forget it (but verify)
| SSL Type | Validity | Renewal |
|---|---|---|
| Let’s Encrypt (free) | 90 days | Auto-renew via host (check every 90 days that it renewed) |
| Paid DV/OV/EV | 1 year | Manual renewal annually — set calendar reminder 30 days before expiry |
How to avoid expiry downtime
- Enable auto-renew (host panel → SSL → Auto-renew ON)
- Set calendar reminder 14 days before expiry
- Monitor with UptimeRobot (free) — alerts if SSL expires or site goes HTTP
- Check GSC weekly for “Not Secure” or indexing of HTTP URLs
Let’s Encrypt never emails you about expiry if auto-renew is working. If you get an expiry email, auto-renew failed — fix it immediately.
SSL and hosting: what to look for when choosing a host
| Feature | Why It Matters | Good Hosts |
|---|---|---|
| Free Let’s Encrypt included | No extra cost for essential security | Hostinger, SiteGround, Cloudways, Kinsta, Namecheap |
| One-click install + auto-renew | No manual CSR, no command line | All above |
| Force HTTPS toggle | One click to redirect all HTTP → HTTPS | Hostinger, SiteGround, Kinsta |
| Wildcard support | Covers all subdomains with one cert | Hostinger, Cloudways, Kinsta (via Let’s Encrypt DNS) |
| HSTS support | Extra security header (see FAQ) | Enabled via plugin or host header settings |
| SSL grade A+ | Strong ciphers, TLS 1.2+ only, HSTS | Achievable on all above with proper config |
Related: Best Hosting for WordPress Websites | Best Web Hosting Services for Small Business Websites in 2026
FAQ: SSL certificates for beginners
Do I need SSL if I don’t take payments?
Yes. Every site needs SSL — even a simple blog. Browsers show “Not Secure” on HTTP, Google ranks HTTPS higher, and even contact forms collect personal data that must be encrypted.
Is free SSL (Let’s Encrypt) safe enough for my business?
Yes — for 95% of business sites. Same 256-bit encryption as paid SSL, same padlock, same browser trust. Paid SSL only adds warranty, organization validation, or dedicated support — not stronger encryption.
How long does it take to set up SSL?
5-15 minutes via hosting one-click + Really Simple SSL plugin. Provisioning takes 2-5 minutes, forcing HTTPS takes 2 minutes.
Will installing SSL break my website?
Rarely, if you follow the steps. The only common issue is mixed content (fixed in Step 3) or a redirect loop if both a plugin and Cloudflare/host try to redirect (fix: set Cloudflare to Full Strict, use one redirect source).
What’s the difference between SSL and TLS?
TLS is the modern version of SSL. The term “SSL” stuck, but all certificates today use TLS 1.2 or 1.3 protocol. When people say “SSL certificate,” they mean “TLS certificate” — same thing in practice.
What is HSTS and do I need it?
HSTS (HTTP Strict Transport Security) tells browsers: “Only ever load this site over HTTPS for the next year.” It prevents downgrade attacks.
Do you need it? Recommended after HTTPS is stable for 30+ days. Enable via:
- Plugin: Really Simple SSL → Settings → Enable HSTS
- Or header (host/CDN):
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Don’t enable HSTS until you’re 100% committed to HTTPS — it’s hard to undo.
Can I have SSL on a subdomain or staging site?
Yes.
- Single-domain cert covers
yoursite.com+www.yoursite.com - Wildcard cert
*.yoursite.comcovers all subdomains (blog, shop, staging) - Let’s Encrypt wildcard is free via DNS validation — most hosts support it
How do I know my SSL auto-renewed?
Check hosting panel → SSL → expiry date — it should be ~90 days in the future for Let’s Encrypt, rolling forward every 60-80 days. Or use SSL Labs Test — it shows expiry date.
Does Cloudflare give me SSL even if my host doesn’t?
Yes, but with a caveat.
- Cloudflare Free provides SSL between visitor ↔ Cloudflare even if origin has no cert
- For full security, set Cloudflare SSL to Full (Strict) and install a valid cert on your origin too (Let’s Encrypt free on origin)
- Don’t use Cloudflare “Flexible” with no origin cert — traffic between Cloudflare and your server is unencrypted
Final recommendation: the beginner SSL standard
For every business website in 2026:
- Get free Let’s Encrypt DV via hosting one-click — 5 min
- Force HTTPS (host toggle or Really Simple SSL) — 2 min
- Fix mixed content (search-replace or plugin) — 5 min
- Verify padlock + SSL Labs A grade — 3 min
- Enable auto-renew + set 14-day expiry reminder — 2 min
Total: 15-20 minutes. Cost: $0. Protection: complete.
Don’t be the business whose site shows “Not Secure.”
Need help setting up SSL? TheWebPal’s Website Maintenance and WordPress Service plans include free SSL setup, HTTPS migration, mixed content fixes, and ongoing renewal monitoring — so you never see an expiry warning. Contact us for SSL setup.
Related resources
- Website Security Checklist for Small Businesses
- Website Backup Guide for Business Owners
- How to Fix a Slow WordPress Website
- Best Hosting for WordPress Websites
- How Website Speed Affects SEO and Sales
- The Ultimate Guide to Web Hosting, Website Design & Online Growth for Small Businesses
- Best Web Hosting Services for Small Business Websites in 2026
- CDN Explained for Small Business Owners