SSL certificate

An SSL certificate is a file installed on the server that holds your website. It does two things. It lets the browser encrypt everything travelling between the visitor and your site, and it lets the browser check that the site really is the one it claims to be. When both work, the address begins with https and the browser says nothing. When they do not, it says a great deal.

In short

• It encrypts what visitors send and proves the site is who it says.
• Free certificates are standard now, and they are not inferior.
• Every certificate is now short lived, so renewal has to be automatic.
• Without one, browsers label your site not secure in front of the visitor.

What it actually protects

The encryption covers the journey. Anything a visitor types travels as unreadable text until it reaches your server, so somebody sharing the coffee shop wifi cannot sit and read the contact forms going past.

That is a real protection and a narrow one. The certificate says nothing about whether your site is safe once the data arrives. A site with a valid certificate, an old plugin and a password of admin is fully encrypted and completely vulnerable. Confusing the two is common, and it is why “we have SSL” is sometimes offered as an answer to a question about security that it does not address.

Free against paid

Certificates used to cost money and be awkward to install. That changed, and a lot of selling still assumes it did not.

• Domain validated. Confirms you control the domain, issues in seconds, free. This is what nearly every small business should use.
• Organisation validated. Adds a check that the company exists. Costs money and shows the visitor nothing extra in a modern browser.
• Extended validation. A heavier company check. Browsers removed the green company name that used to justify it back in 2019, so the visible benefit a buyer was paying for no longer appears anywhere.
• Wildcard. Covers one level of subdomain at once, so it handles shop and blog under your domain but not anything nested deeper, and not the bare domain unless that is listed separately.

What a visitor sees is identical in every case, because browsers stopped distinguishing between them years ago. Nobody has ever chosen a restaurant because it bought the expensive certificate.

Why sites go red without warning

This is the failure that costs businesses real money, and it is almost always the same failure.

Certificates used to last about a year, and the industry has been shortening that deliberately. Since March 2026 the maximum any certificate can be issued for is two hundred days, and the schedule already agreed cuts it further over the following years. The practical effect is that manual renewal has stopped being viable for anybody, not only for the people using free certificates.

So renewal runs automatically, as a small job on the server, and small jobs stop. A setting changes, a plugin updates, the domain moves, and the renewal fails quietly because nothing is watching it. Nothing breaks on the day. Then the certificate expires and every visitor meets a full page warning telling them the site is not safe.

Most owners find out from a customer. The fix takes minutes and the damage was done over however many days it sat there, which is why this belongs in whatever hosting arrangement you have rather than on your own list of things to remember.

Mixed content

A site can have a perfectly valid certificate and still behave oddly, and the cause confuses people because the certificate itself is fine.

It happens when a secure page loads something over the old insecure address. An image, a script, a font, usually hard coded into a page or a theme years ago. Browsers no longer just warn about this. Scripts and frames loaded insecurely are blocked outright, and insecure images are quietly upgraded or dropped. So the symptom today is rarely a security message. It is a missing photograph, a form that does not submit, or a slider that never appears, on a page that looks fine to whoever built it.

It surfaces most often just after a site moves to https, when most links were updated and a handful were missed. Finding them is a search through the pages for the old address, and it is a job worth doing properly once rather than page by page as complaints arrive.

Where it sits in search

The ranking effect is real, confirmed, and small enough that it should not be the reason you act.

The reason to act is the browser. Pages served without encryption are marked as not secure in the address bar, and forms on them can produce a warning directly on the page. That message is aimed at your customer, in language they understand, at the moment they were about to send you something. Ranking factors are an argument between marketers. A warning is an argument you are having with the visitor. How this fits with everything else on a site is on the technical SEO entry.

Moving a site that never had one

Sites still exist without encryption, usually older ones that have run quietly for years, and the move is more than installing a file.

Every internal link, image and script hard coded to the old address has to be updated, or those parts simply stop loading, as described above. Every version of the address needs to forward to one chosen version, so that the site does not exist twice as far as search engines are concerned. Anything pointing at the site from outside keeps using the old address indefinitely, which is what the forwarding is for.

Done properly the move is uneventful and rankings hold. Done partially it produces duplicate addresses, mixed content warnings and a period where nobody is certain which version is the real one. It is worth treating as a small project rather than a setting.

Five minutes, once a quarter

Certificates fail on a schedule nobody controls, so the check is worth putting in the calendar rather than doing when something looks wrong.

• Open the site and look at the address. It should say https, and the browser should not be calling it not secure, on every page rather than on the home page alone.
• Type the address without https and confirm it forwards rather than loading separately. Two versions of a site cause problems well beyond security.
• Check a page with a form, since that is where browsers complain loudest.
• Find out who renews it, and whether anybody is told if the renewal fails.
• Check the expiry date. Click the icon to the left of the address and open the connection details. Chrome replaced the old padlock with a neutral icon in 2023, so this is a different picture than you may remember.

The last two matter more than the rest. A certificate that exists is normal. A certificate somebody is responsible for is the part most small businesses are missing, and it is the difference between a quiet renewal and a red screen on a Saturday.