IN THIS ARTICLE · 6 PARTS
When you visit a website and see a padlock next to the address, and the address starts with https://, the site uses an SSL certificate. It is now a basic requirement for every website, not an extra.
What it does
In technical terms, HTTPS is the encrypted version of the HTTP protocol, protected with TLS [1].
An SSL certificate (technically, today it is TLS, but everyone still says SSL) does two things:
- Encrypts the connection between the visitor's browser and your website, so nobody in between can read or change what is sent, such as a contact form, a password or a payment.
- Confirms the website's identity, so the visitor knows they are connected to the real domain.
Why every website needs one
Since Chrome 68 in July 2018, Google's browser labels every HTTP site as "not secure" [2], and Google has used HTTPS as a ranking signal since 2014 [3].
- Browsers warn visitors. Without a certificate, browsers mark the site as "not secure". Many visitors leave immediately, and almost nobody fills in a form on such a site.
- Google prefers secure sites. Using HTTPS is part of a healthy, modern website and good SEO practice: SEO for a business website: where to start.
- Personal data. If your site has a contact form, it collects personal data, which should be sent securely.
- Trust. The padlock is one of the signals visitors use, often without thinking, to decide whether a business is real.
Does it cost money?
Not necessarily. Free certificates, for example from Let's Encrypt, are widely used and secure. Paid certificates exist for special cases, such as extended company verification, but most small businesses do not need them. Let's Encrypt describes itself as a free, automated and open certificate authority, run for the public's benefit [4].
What matters is not the price but that the certificate is installed correctly, covers all versions of your address (with and without www) and is renewed automatically before it expires.
What happens when it expires
An expired certificate is almost as bad as none: browsers show a full-page warning, and most visitors turn back. This is one of the most common problems on sites nobody looks after. See what website maintenance includes.
The padlock is not a feature anymore; it is the minimum. Make sure it is there, and that someone keeps it there.
Included with Studio V1
Every Studio V1 website comes with an SSL certificate that is set up and renewed for you, together with domain and hosting: see our monthly plan. For the bigger picture, read domain and hosting: what they are and how to choose.
References
- MDN Web Docs (Mozilla). "HTTPS." developer.mozilla.org
- Engadget. "Upcoming Chrome update will label HTTP sites 'not secure' (February 2018)" engadget.com
- Google Search Central Blog. "HTTPS as a ranking signal (2014)" developers.google.com
- Let's Encrypt. "About Let's Encrypt." letsencrypt.org
