What is an SSL certificate, and why did it become mandatory?
What does the padlock in the address bar mean? What happens on a site without SSL, and what's the real difference between free and paid certificates?
The padlock in your browser's address bar shows that the site is using a secure connection. Without it, the browser prints a "Not secure" warning to the visitor — and most visitors turn back the moment they see it.
What SSL actually does
It encrypts the traffic between the visitor's browser and your server. Without encryption, someone on the same network (café Wi-Fi, for instance) can read what's being sent: the message typed into your contact form, a login password, even order details.
What it does not do: it makes no promise that your site's content is accurate or honest. The padlock says the connection is secure, not that the site means well.
Why it's now mandatory
Three reasons:
- Browsers warn about it. Chrome and Safari show an explicit warning on pages without SSL.
- Google counts it. HTTPS has been a ranking signal for years.
- Payment providers require it. You cannot set up card payments on a site without SSL.
Is a free certificate enough?
For most sites, yes. Let's Encrypt is free, renews itself every 90 days, and its encryption strength is identical to paid certificates. Nearly every host installs it in one click.
Paid certificates sell something different: identity verification. With OV and EV certificates the provider confirms with documents that the company genuinely exists. That matters for banks and large retailers; for a small brochure site it's unnecessary expense.
Three things people forget after installing
1. Redirects. The http:// address should redirect automatically to https://. Otherwise the site stays reachable at two addresses and search engines may treat it as duplicate content.
2. Mixed content. If the page is HTTPS but an image on it loads over HTTP, the padlock still shows as broken. Every link should be https.
3. Renewal. If auto-renewal isn't working, the certificate quietly expires after 90 days and the site greets visitors with a warning one morning. Check that renewal runs.
- #ssl
- #https
- #security
