What is an SSL certificate, and does your website need one?

What does an SSL certificate do?

An SSL certificate lets a visitor’s browser connect to your website privately. It’s why your address starts with https instead of http. The certificate ties your website to your domain name, so the browser knows it’s talking to the right site, and the connection is encrypted so other people on the network can’t read it or change it without being detected.

SSL is actually the older name. Mozilla’s developer documentation describes TLS as formerly known as SSL, and says SSL has been superseded by TLS, which is what’s used today. Everyone still says SSL, so we will too.

Does your website need one?

Yes. Chrome’s help page says that when a site shows “Not secure”, the site doesn’t use a private connection, so others may be able to view or change what you send and receive. It also says only the site owner can fix this, by moving to https.

Say a tradie in Redcliffe has a contact form on the website. Someone fills in their name, number and address. Without https, that goes across the network without protection. Your visitors can’t fix that. You can.

Google also lists serving pages securely among its page experience questions, and Search Console has an HTTPS report that shows which of your pages aren’t served over https.

How to check yours

1. Open your website in Chrome and look at the left of the address bar. Chrome shows a security status symbol there. If the site doesn’t use a private connection, it says “Not secure”.
2. Click that symbol. It shows a summary of the site’s connection and privacy details.
3. Type your address with https:// at the front. If the site loads without a warning, the certificate is working. Then check that typing http:// sends you to the https version.

Do you have to pay for one?

Usually not. Let’s Encrypt is a free certificate authority run by a nonprofit, the Internet Security Research Group, and anyone who owns a domain name can get a certificate from it at no cost. Many hosting companies include a free certificate and install it for you. Ask your host before buying one separately.

Certificates also come in different types. Let’s Encrypt issues domain validated certificates. Organisation and extended validation certificates exist too, where the issuer checks more about the business behind the site. For many small business websites a free domain validated certificate is enough.

Certificates expire

Let’s Encrypt certificates are valid for 90 days by default at the moment, and it recommends renewing them every 60 days. It has announced that it will shorten that default, so renewals will come round more often. The software on the server normally does that automatically. Certificates bought from other providers expire too, and somebody has to renew them.

When one runs out, browsers warn visitors before they reach your site. In Chrome this is often a full-page “Your connection is not private” warning. Chrome says that warning can point to a problem with the site, the network or the visitor’s own device, so an expired certificate isn’t the only cause. Check your own device’s date and time first, and try another network. If it’s only your site, ring your host.

Fixing a “Not secure” warning

1. Get a certificate installed. Ask your host, or the person who looks after your site.
2. Make http go to https. Google says to use permanent server-side (301) redirects from the old addresses to the new ones, and that 301 redirects don’t cause a loss in PageRank.
3. Tell WordPress. In WordPress, the WordPress Address and Site Address in Settings, General should start with https. The Site Health screen checks this.
4. Fix mixed content. This is when a secure page loads something over plain http, like an old image or a script. Mozilla’s documentation says browsers upgrade some of these automatically, such as images, and block others, such as scripts and stylesheets, so a page can look broken. Fix it by changing those links to https.
5. Check Search Console. Google says you don’t need a Change of Address request for a move from http to https.

None of this changes how your site looks. If it all feels fiddly, it’s the sort of thing your web person should sort out in a short job.

What an SSL certificate doesn’t do

It makes the connection private. It doesn’t make your website secure from hackers, and it doesn’t prove the business behind a site is trustworthy. Chrome’s own help page still advises caution with sensitive information even on a secure connection. Keeping WordPress, plugins and themes updated is a separate job. Here’s what website maintenance involves, and what to do if your site has been hacked.

Questions people ask

What is the difference between SSL and TLS?

TLS is the newer version of SSL. Certificates sold or described as SSL today actually use TLS, but the old name stuck.

What does “Not secure” mean on my website?

Chrome says it means the site doesn’t use a private connection, so others may be able to view or change what visitors send and receive. Moving the site to https fixes it.

Can I get an SSL certificate for free?

Yes. Let’s Encrypt is a free certificate authority, and many hosts include a free certificate with their plans. Ask your host first.

Do I need to move to https if my site only has a phone number and no forms?

Chrome flags any site that doesn’t use a private connection, whether it has a form or not, so it’s worth doing. It’s also usually free.

Seeing a warning on your site and not sure why? Ask for a free website check and we’ll tell you what we can see. If you’d like the certificate, updates and backups handled for you, see our website care plans.