Yes, every public website needs HTTPS (the modern form of what people still call SSL). It encrypts data moving between your visitor's browser and your server, and it stops the browser warnings that chase visitors away and can hurt your search rankings. If you haven't checked yet, look at your address bar now: a padlock and "https://" mean you're covered.
TL;DR:
- HTTPS encrypts data, verifies server identity, and prevents tampering, with a padlock icon and "https://" in the URL indicating protection.
- All public sites should use HTTPS, especially those collecting personal data, handling logins, processing payments, or loading third-party resources.
- Free certificates from Let's Encrypt suffice for most small websites, with paid options reserved for validation or support needs.
- Check your site’s HTTPS status quickly by testing URL redirects and fixing mixed-content issues before launching or migrating.
- Regularly renew certificates and ensure automatic renewal is enabled to avoid security warnings and maintain trust.
Table of Contents
- What HTTPS actually does and why people still say "SSL"
- Who actually needs HTTPS: a quick checklist
- Free vs paid certificates: when it's worth paying
- How to check your site and switch on HTTPS
- Renewal and automation: keeping HTTPS reliable
- What HTTPS doesn't cover, and what else you need
- How HTTPS fits into a proper small-business website build
- If you'd rather have it done: Webnora services for websites with HTTPS
- Sources
- FAQ
What HTTPS actually does and why people still say "SSL"
HTTPS is HTTP running over TLS, the protocol that replaced the older SSL standard years ago. The name "SSL" stuck around in everyday use, but TLS is what's actually doing the work on almost every secure site today, according to Cloudflare's technical explainer.
TLS does three jobs at once: it encrypts the data passing between browser and server, it confirms the server is who it claims to be, and it checks that data hasn't been tampered with in transit. You can see the result without any technical knowledge:
- A padlock icon in the browser's address bar
- A URL starting with "https://" instead of "http://"
- Traffic running over port 443, the standard port for secure connections
None of this requires you to understand the cryptography behind it. You just need to know the padlock means the connection is protected, which matters the moment your site handles anything personal.
Who actually needs HTTPS: a quick checklist
Some site owners still ask whether a simple blog or portfolio really needs it. The honest answer is yes for every public site, but the reasons get stronger depending on what your site does.
- Does your site collect personal data through forms, newsletters or comments? HTTPS is required.
- Does it have a login area, member account or customer dashboard? HTTPS is required.
- Does it process payments or handle card details directly? HTTPS is required, often alongside additional compliance standards.
- Does it load scripts, fonts or widgets from third-party domains? HTTPS prevents those connections from being intercepted or altered.
- Do you want visitors to trust the site at a glance? HTTPS removes the "not secure" label that modern browsers attach to plain HTTP pages.
Even a brochure site with no forms benefits, because browsers now treat HTTPS as the baseline rather than an extra. The ICO's guidance on encryption and data transfer notes that organisations should use HTTPS across all pages, not just the ones that look sensitive, as part of meeting their wider data-protection obligations.
Pro Tip: If you're unsure whether your site is fully covered, check every page type individually, including your contact form and any embedded booking widgets, not just the homepage.
Free vs paid certificates: when it's worth paying
For most personal and small-business sites, a free certificate is all you need. Let's Encrypt is a nonprofit certificate authority that issues free Domain Validation certificates after confirming you control the domain, and that level of validation covers the vast majority of everyday websites.
Paying for a certificate makes sense in specific situations:
- You need Organisation Validation or Extended Validation because a partner, supplier or procurement process requires proof of your company's legal identity
- You want a paid support contract attached to the certificate, rather than relying on community documentation
- Your hosting or compliance framework specifically mandates a commercially issued certificate
Outside those cases, a free Domain Validation certificate does the same encryption job as a paid one. The padlock looks identical to a visitor either way, and the security benefit is the same. Spend the money elsewhere unless a genuine business requirement says otherwise.
How to check your site and switch on HTTPS
Checking your current status takes thirty seconds. Type your domain into the address bar and see whether it loads as "https://" automatically, whether a padlock appears, and whether typing the "http://" version redirects you straight to the secure one.
If it doesn't, here's how most small sites get there:
- Check your hosting control panel first. Many hosts now offer one-click HTTPS setup using Let's Encrypt behind the scenes.
- If your host doesn't offer it, consider a service like Cloudflare, which can issue and manage certificates at the network level even if your origin server lacks one.
- For a self-hosted server, install a certificate directly using the ACME protocol that Let's Encrypt supports, usually through a client tool your developer sets up.
- Once HTTPS is live, set a permanent redirect from "http://" to "https://" so every old link and bookmark still works.
After switching, run a few checks. Open your browser's console and look for mixed-content warnings, which happen when a secure page still loads an image or script over plain HTTP. Confirm your analytics tool is still tracking correctly, and check that canonical tags point to the "https://" version, as Cloudflare notes is a common place sites lose SEO value during migration.
Pro Tip: Test the switch on a staging copy of your site first if you can, so any mixed-content issues get caught before visitors see them.
Renewal and automation: keeping HTTPS reliable
Certificates expire, and letting one lapse brings back the exact warnings you were trying to avoid. Let's Encrypt certificates historically carry a 90-day lifetime, deliberately short so that renewal gets automated rather than left to memory, according to Let's Encrypt's own documentation.
A few things worth checking:
- Confirm whether your host automates renewal, since most mainstream hosting platforms and panels do this without you noticing
- If you manage a server yourself, check that the ACME renewal script and its scheduled task are both actually running, not just installed
- Set up a simple expiry alert, even a calendar reminder, so a failed renewal doesn't go unnoticed until a visitor sees a warning
- If a renewal fails, check domain ownership records and DNS settings first, since most failures trace back to those rather than the certificate itself
Short lifetimes exist to limit the damage if a key is ever compromised, so treat renewal as routine maintenance rather than an occasional chore.
What HTTPS doesn't cover, and what else you need
HTTPS protects data while it's moving between browser and server. It does nothing to stop a server being hacked, a plugin being outdated, or malicious content being served from a site that's otherwise fully encrypted, as Heimdal Security points out.
It's also not proof that a site is trustworthy. A phishing site can carry a valid HTTPS certificate just as easily as a legitimate business, because the padlock certifies the connection, not the operator's intentions.
HTTPS adoption is now close to universal across the web, and Google treats it as a baseline ranking signal, flagging plain HTTP pages as "not secure" in the browser itself, according to Cloudflare.
Pair HTTPS with these basics:
- Keep your platform, plugins and themes updated
- Use strong, unique passwords and enable two-factor authentication where available
- Add a Content Security Policy to reduce the risk from third-party scripts
- Keep regular backups in case something still gets through
How HTTPS fits into a proper small-business website build
HTTPS shouldn't be a setting someone remembers to flip on later. It belongs in the build itself, checked before a site goes live rather than patched in afterwards. That means confirming every page loads securely, every redirect works, and no script sneaks in over plain HTTP.
A lightweight, fast site that's also fully secured gives small business owners one less thing to worry about once the site is live, and it signals to both visitors and search engines that the site was built with care rather than assembled from a template and left alone.
— Ar
If you'd rather have it done: Webnora services for websites with HTTPS
Custom website services can include HTTPS configuration and testing as a standard part of the build rather than an afterthought. Sites may be built from scratch and can offer review-before-payment options to ensure satisfaction with the finished result.
- Business Websites, Personal Websites and Landing Pages built without use of recycled templates
- HTTPS setup and basic SEO fundamentals may be included as part of the build process
- Website Redesigns for sites needing a secure, modern rebuild
- Review-before-payment process options, allowing site review before payment
Take a look at the services page to see what's included, or check how the process works from first enquiry to approved, secure website.
Sources
FAQ
Why is SSL not used anymore?
SSL as a protocol was replaced by TLS years ago because TLS is more secure, but the name "SSL" stuck in everyday language. When people ask about "SSL certificates" today, they almost always mean a TLS certificate securing HTTPS.
Should SSL be turned on?
Yes, every public website should run HTTPS. It protects any data moving between visitors and your server and removes the "not secure" warning that modern browsers show on plain HTTP pages, as Cloudflare explains.
What happens if I don't have an SSL certificate?
Visitors see a "not secure" warning in their browser, which damages trust immediately, and any data submitted through forms travels unencrypted. It can also work against your search visibility, since HTTPS is a recognised ranking factor.
Is SSL being phased out?
The SSL protocol itself was phased out long ago in favour of TLS, but HTTPS, the thing people still call "SSL," is more essential than ever. Free options like Let's Encrypt's Domain Validation certificates mean there's no cost barrier to adopting it.
Do I need to pay for an SSL certificate?
Most small business and personal sites don't need to. A free Domain Validation certificate from a provider like Let's Encrypt gives the same encryption as a paid one, and paying only makes sense if you specifically need organisation-level validation or a support contract.