SSL Certificates and HTTPS, Explained Without the Jargon
What the padlock actually means, why you should never pay much for one, and the renewal failure that takes sites down every year.
Dollar figures in this article are US dollars. Our Australian prices are on the pricing page.
Somebody has told you your site needs an SSL certificate, or your browser has started showing "Not secure" next to your address, or a salesperson has quoted you US$300 a year for something you suspect should be free.
All three situations resolve to the same short set of facts.
Short version. HTTPS encrypts traffic between the visitor and your site. Certificates are free through Let's Encrypt and every decent host issues and renews them automatically. Paying more buys warranty and support, not better encryption. The padlock proves the connection is private — not that the business is trustworthy.
What It Actually Does
Without HTTPS, everything traveling between a visitor and your website is readable by anything in between — the café wi-fi, the network operator, whoever is running the router. That includes anything typed into a form.
HTTPS does two things: it encrypts that traffic, and it verifies that the server answering is genuinely the one for that domain. The certificate is what proves the second part.
What it does not do is say anything about the business. A phishing site can have a perfectly valid certificate and a padlock. The padlock means "this connection is private", never "these people are honest" — which is why browsers have steadily de-emphasized it.
Yes, You Need It — Even for a Brochure Site
The common objection is "we do not take payments". It is still required, for four reasons:
- Browsers mark HTTP pages as "Not secure", prominently, next to your address. Visitors read that as "this business is dodgy".
- Your contact form collects personal data, which means a name, an email and a phone number are traveling in the clear.
- It is a lightweight ranking signal, and has been for a decade.
- Modern browser features require it. An increasing amount simply does not function over HTTP.
What to Pay
Nothing, in almost every case. Let's Encrypt issues free domain-validated certificates and is supported by every reputable host, usually automatically. The encryption is identical to a paid certificate — the mathematics does not know what you paid.
Paid certificates buy three things, none of which matter to most small businesses: a warranty, human support during issuance, and — for the expensive tiers — organization validation, where the issuer verifies your legal entity. Extended Validation certificates once produced a green bar with the company name; browsers removed that display years ago, which removed most of the point.
Two situations where paying is reasonable: a wildcard certificate covering many subdomains where free automation is awkward, and organizations with a compliance requirement naming a specific certificate type. Otherwise, if a host is charging you US$200 a year for SSL, you are paying for something they get free — which is a useful signal about the rest of their pricing. See choosing hosting.
The Failure That Takes Sites Down
Let's Encrypt certificates last 90 days. That short life is deliberate — it forces automation — but it means a renewal that quietly stops working takes your site fully offline within three months, with a full-page browser warning rather than a subtle one.
It is one of the most common causes of a small business site becoming unreachable, and it always happens at the worst time because nobody is watching for it.
Two defenses:
- Confirm renewal is automatic, and that failures alert somebody. "It renewed last time" is not the same as "it is monitored".
- Monitor the expiry date externally. Something that checks the certificate from outside and warns you weeks ahead. Our own Findable does this as part of its weekly checks, and the free tier includes it.
Installed and Still Not Working
A certificate on its own is not the whole job. Three things go wrong afterwards:
- Mixed content. The page loads over HTTPS but pulls an image, script or stylesheet over HTTP. The browser downgrades the padlock or blocks the resource entirely, which frequently breaks the layout. Usually caused by hard-coded
http://URLs in the database after a migration. - No redirect from HTTP. Both versions remain reachable, which splits your ranking signals across two addresses. Force HTTPS with a 301, the same principle as any URL change.
- www and non-www not unified. Pick one, redirect the other, and make sure the certificate covers both.
Checking Yours
- Visit your site and click the padlock. Look at the expiry date.
- Type
http://in front of your domain deliberately. It should redirect to HTTPS, not load. - Try it with and without
www. Both should end up in the same place with no warning. - Open the browser console on your main pages and look for mixed content warnings.
- Run a free third-party SSL test for the full configuration report.
Five minutes, once, and then let something else watch the expiry date — because the one failure mode that actually costs you money is the renewal nobody was monitoring.
Common Questions
Do I Need an SSL Certificate If My Website Does Not Sell Anything?
Yes. Browsers mark plain HTTP pages as "Not secure" next to your address, which visitors read as untrustworthy. Your contact form also collects personal data that would otherwise travel in the clear, HTTPS is a lightweight ranking signal, and a growing number of browser features simply do not work without it.
How Much Should an SSL Certificate Cost?
Nothing, in almost every case. Let's Encrypt issues free certificates and every reputable host supports them, usually with automatic renewal. The encryption is mathematically identical to a paid certificate. If a host charges US$200 a year for SSL, they are billing you for something they get free.
What Is the Difference Between Free and Paid SSL Certificates?
Not the encryption, which is the same. Paid certificates add a warranty, human support during issuance, and at higher tiers organization validation. Extended Validation certificates used to show a green bar with the company name, but browsers removed that display years ago, which removed most of the reason to buy one.
Why Did My Website Suddenly Show a Security Warning?
Most often an expired certificate. Let's Encrypt certificates last 90 days and renew automatically — when that automation quietly fails, the site becomes unreachable behind a full-page browser warning within three months. Confirm renewal is automated, that failures alert someone, and monitor the expiry date externally.
What Is Mixed Content and Why Does It Break My Padlock?
A page served over HTTPS that loads an image, script or stylesheet over plain HTTP. The browser either downgrades the padlock or blocks the resource, which often breaks the layout. It is usually caused by hard-coded http:// URLs left in the database after a migration.
