If you have ever typed a web address and seen a little padlock next to it, you have seen HTTPS at work. If you have seen a red "Not secure" warning instead, you have seen what happens without it.

An SSL certificate is what moves your website from HTTP to HTTPS. It is not a nice-to-have anymore. It is the baseline, and a site without it is quietly costing you trust, rankings and sometimes sales.

Here is what it actually does, what goes wrong without it, and how to get it sorted.

What an SSL certificate actually does

When someone visits your website, data travels between their browser and your server. On plain HTTP, that data moves as readable text. Anyone sitting on the same network, a coffee shop Wi-Fi, a dodgy router, an internet provider, can in principle see it.

An SSL certificate (more accurately TLS these days, but everyone still says SSL) encrypts that connection. It does two jobs:

• Encryption. The data between the visitor and your server is scrambled so it cannot be read in transit.
• Identity. The certificate confirms the visitor is actually talking to your server and not an imposter sitting in the middle.

That is what the padlock means. Not that your site is "safe" in every sense, but that the connection is encrypted and the domain is verified.

What happens without it

This is the part people underestimate. Running on HTTP in 2026 does not just mean "no padlock". It actively works against you.

Browsers flag you. Chrome, Safari, Firefox and Edge all show a "Not secure" label on HTTP pages. On any page with a form, that warning gets louder. A visitor about to type their email or card details sees a security warning right at the moment of commitment. Most will leave.

Google treats HTTPS as a ranking signal. Google has used HTTPS as a lightweight ranking factor for years and openly prefers secure pages. All else being equal, the secure version wins. If you are trying to climb the results, running on HTTP is an easy own goal.

Forms and logins are exposed. Any contact form, booking form, login or checkout on HTTP sends what people type without encryption. That is a genuine data risk, and in some cases a compliance one.

Modern features refuse to load. Plenty of browser features now require HTTPS to work at all: geolocation, camera access, service workers for faster loading, and much of the modern web app toolkit. On HTTP, they are simply blocked.

Referral data disappears. Traffic moving from a secure site to an insecure one often loses its referrer information, so your analytics get muddier and harder to trust.

The good news: it is usually free

Years ago, certificates were a paid product you bought and renewed each year. That is no longer the default. Let's Encrypt, a non-profit certificate authority, issues trusted certificates at no cost, and most decent hosting now installs and renews them automatically.

If your website is built and hosted properly, HTTPS should already be on, with renewals handled in the background. On our own builds we treat it as a non-negotiable part of launch, the same way we treat a site loading quickly or working on a phone. It is covered as standard in how we approach engineering.

So if you are being quoted extra for "SSL" as a line item, ask why. For a standard business website, it should be included.

Do you need a paid certificate?

For most small and medium businesses, no. A free certificate from Let's Encrypt gives you the exact same encryption and the same padlock as a paid one. The browser does not grade you on which authority issued it.

Paid certificates mainly add things like extended validation (the fuller company-name checks) or warranty cover, which matter for large financial institutions far more than for a local firm. If someone tells you that you must buy an expensive certificate to be secure, they are overselling.

The quality of your website is decided by how it is built, not by how much your certificate cost.

Common mistakes we see

Getting a certificate installed is only half the job. These are the issues that trip sites up even when SSL is technically present.

Mixed content. Your page loads over HTTPS, but an image, script or font on it still loads over HTTP. Browsers then show a broken or partial padlock and may block the insecure resource. Every asset needs to be served securely.

No redirect from HTTP to HTTPS. Both versions of the site stay live. Visitors and Google can land on the insecure one. You need a permanent redirect forcing everything to the HTTPS version.

www and non-www confusion. If your certificate covers one but not the other, visitors hit a scary certificate error on the version it does not cover. Both should resolve cleanly to a single preferred address.

Expired certificates. Free certificates renew automatically when set up correctly, but a misconfigured server can let one lapse. An expired certificate throws a full-screen browser warning that stops people entering your site entirely. Monitoring matters.

How to check your own site in two minutes

You do not need to be technical to spot the basics.

1. Open your website and look at the address bar. Does it start with https:// and show a padlock?
2. Type http:// in front of your domain by hand. Does it jump to the secure version, or stay on HTTP?
3. Click into a page with a form or a logo-heavy section. Is the padlock still intact, or does a warning appear?
4. Visit both www.yourdomain and yourdomain without the www. Do both work without a certificate error?

If any of those fail, you have a fix to make. None of them are big jobs, but all of them affect how visitors and Google see you.

Where this fits with everything else

HTTPS sits alongside the other quiet technical foundations that decide whether a site performs. Speed, mobile layout, clean structure and secure connections are the plumbing. They rarely win awards, but when they are wrong, nothing above them works properly. If you are reviewing the technical health of your site, our technical SEO checklist for a small business walks through the rest of the foundations worth getting right.

The short version: a padlock is not a badge, it is a baseline. Get it in place, make sure it redirects properly, keep it renewing, and then spend your energy on the things that actually set you apart.

If you are not sure whether your site passes the two-minute check, we are happy to take a look.

Lewis, Technical Director