SSL and https: why your site needs the padlock

SSL is the technology that scrambles the information traveling between your visitor and your website, so nobody in the middle can read it or change it. When a site has it, the address starts with https instead of http. This lesson explains what SSL and https are, why every business site needs them, what is changing in 2026 with certificate lifetimes and Chrome, and how to fix the usual warnings.

What SSL and https are

Imagine sending a postcard and sending a sealed envelope. Anyone who handles the postcard can read it, while the envelope keeps the message private. A website without protection works like the postcard: the information passes through many computers on its way, and any of them could read it. A website with SSL works like the envelope.

When you fill in a form, the data travels from your phone to the server through networks you do not control: a coffee shop's wireless connection, an internet provider, a router. Encryption turns that data into code that only the visitor's browser and your server can read.

SSL, TLS and certificate: three words for one idea

• SSL stands for Secure Sockets Layer. It is the old name, and people still use it.
• TLS stands for Transport Layer Security. It is the modern version of the same technology. When someone says SSL today, they almost always mean TLS.
• A certificate is a small file installed on your host. It proves that the site really belongs to your domain and switches on the encryption.
• https is the regular web protocol with that secure layer added. The s stands for secure.

What the padlock does and does not mean

For years, browsers showed a padlock next to the address of a secure site. Chrome replaced it in 2023 with a neutral icon that opens the connection details, while other browsers still show a lock. Whatever the icon, it tells you two things: the connection is encrypted, and the site matches its certificate.

It does not tell you that the business is honest or that the site cannot be hacked. Scam sites use https too. The padlock protects the journey of the data, not the character of the owner. That is why https is the minimum for a trustworthy site, not proof of one.

Why every business site needs https

• It protects what people type. Names, emails, phone numbers, messages, passwords and payments should never travel in the open. Even a simple contact form carries personal information.
• Browsers warn about sites without it. Chrome has labeled plain http pages as "Not secure" for years. Google also announced that, starting with Chrome 154 in October 2026, Chrome would ask for a secure connection by default and show a warning before opening a public site that does not support https. A visitor who sees a warning usually leaves.
• It builds trust. Customers notice when a site looks safe, and they notice louder when it does not.
• Google likes it. Google announced in 2014 that https is a light ranking signal. It will not carry a weak site to the top, but a site without it starts at a disadvantage.
• Many tools require it. Payment providers, browser features such as location and many integrations only work on secure pages.
• It protects your reputation. A site that is altered on the way, with ads or malicious code injected into it, reflects badly on you.

There is no exception for small sites or for sites without forms. Every business site needs https.

What the warnings mean and who fixes them

• "Not secure" next to the address. The page is loaded over http, or it mixes secure and insecure parts. You or your host must install a certificate and redirect http to https.
• "Your connection is not private." The certificate has expired, was installed incorrectly, or the visitor's own device has the wrong date. Check the expiry date first, and renew or reinstall the certificate.
• Mixed content. The page is secure, but it loads an image, a script or a font over http. Change those links to https. Your builder or host can find them.
• The certificate does not match the name. The certificate was issued for one address, such as the version without www, and the visitor used another. Ask your host to cover both versions.

If a visitor tells you they see a warning, do not wave it away. Check it yourself on a phone and a computer.

Types of certificates and what you need

• Domain validation (DV). Proves you control the domain. It is issued in minutes, and it is all that most small businesses need. Free options exist, such as certificates from Let's Encrypt, a nonprofit certificate authority, and many hosts install one for you.
• Organization validation (OV) and extended validation (EV). Add checks of the business's identity. Most browsers no longer highlight them in the address bar, so for a small site they add cost and little else.
• Wildcard certificates. One certificate for a domain and all its subdomains.
• Multi-domain certificates. One certificate for several different domains.

The encryption of a free certificate is as strong as that of a paid one. Paid certificates add things like a warranty, business validation and support. Do not pay twice: if your host provides a certificate, you do not need to buy another.

Certificates are getting shorter, so renewal must be automatic

Certificates do not last forever. Under rules agreed by the browser makers and the companies that issue certificates, the maximum lifetime of a public certificate is shrinking in steps:

• Since March 15, 2026, a certificate can last at most 200 days.
• From March 15, 2027, the limit drops to 100 days.
• From March 15, 2029, it drops to 47 days.

The old habit of renewing a certificate once a year by hand is ending. A forgotten renewal makes your site show a warning to every visitor, so renewal has to be automatic. Check that your host or studio renews your certificate on its own, and ask who is responsible if it fails. If you buy a certificate separately, set it to renew automatically.

How to get https on your site, step by step

1. Look for the free certificate at your host. Most hosting control panels have an SSL or certificate section. Activate the certificate for your domain, including the version with www.
2. Set your site to use https. The site address in your settings should begin with https.
3. Redirect http to https. Anyone who types the old address should land on the secure page automatically.
4. Fix mixed content. Update any image, script or link that still uses http.
5. Update your links. Check your Google Business Profile, your social profiles, your email signature and any ads.
6. Test. Visit the main pages on a phone and a computer. A free test such as the SSL Server Test from Qualys SSL Labs checks the setup in detail.
7. Turn on automatic renewal. Then put the expiry date in your calendar anyway.

If your site uses a website builder or WordPress

Website builders normally switch on https for you, and you only need to check that your own domain is connected to it. With WordPress, the certificate comes from your host, and you then set the site address to https and fix any old links. A plugin can help to find mixed content, but the simplest fix is to ask the person who built the site to run a search and replace on the old addresses.

What happens to your rankings when you switch

If your site has been on http and you move it to https, the address of every page changes. A correct redirect from each old address to its new one tells Google that the pages moved, and your listings carry over. A missing or broken redirect can make pages drop out of search results for a while. Test a few pages by typing the old address and watching where you land.

How to check any site in two minutes

You can check your own site, and a competitor's, without special tools.

• Look at the address. It should start with https, and the browser should show no warning.
• Click the icon next to the address. It should say that the connection is secure, and it lets you look at the certificate and its expiry date.
• Open the site on a phone, too, and use your own contact form to see that nothing looks wrong.
• Try the version of your address without www, and with it. Both should end up on the same secure page.

Who is responsible for your certificate

A certificate involves several people, and a gap between them is how renewals get forgotten. Whether you work with a host, a studio or a freelancer, ask these three questions and keep the answers in writing.

1. Who installs the certificate, and who renews it?
2. What happens if a renewal fails, and who receives the alert?
3. If I move to another host, who sets up the certificate again?

If the answer to the first question is "you", set a reminder and learn where to click. If the answer is "the host" or "the studio", ask how they would tell you about a problem before your visitors find it.

Common mistakes

• Letting the certificate expire. The most common problem, and now easier to cause because certificates are shorter. Use automatic renewal.
• Securing only the home page. Every page should load over https.
• Forgetting the www version. The certificate should cover both versions of your address.
• Leaving old http links around. They create mixed content and cause warnings.
• Paying for a certificate you already have. Many hosts include one.
• Thinking https is the end of security. It protects data in transit. You still need updates, strong passwords and backups.

https and your website

A secure connection is one piece of keeping a site safe. At Good Sites Only, hosting is included with every site, and the Care maintenance plan, a monthly service you can add, covers backups, updates and security. You can see the sites we build in our designs.

Questions people ask