Do I need an SSL certificate?
Short answerYes. Every business website needs an SSL certificate, even one without a shop or login. Without it, browsers label your site “Not secure”, contact form data travels unencrypted, and Google treats HTTPS as a small ranking signal. Most good hosts include a free certificate that renews automatically, so cost shouldn’t be a reason to skip it.
Seeing “Not secure” on your site?
Send me the link and I’ll tell you exactly what’s causing the warning and how to clear it. Free, within two business days.
The longer answer
What SSL actually does
An SSL certificate lets a browser and your server talk over an encrypted connection. That’s what turns http:// into HTTPS and shows the padlock. It means nobody on the same café Wi-Fi can read what someone types into your contact form, and nobody along the way can quietly change the page they receive.
Strictly speaking, modern certificates use TLS rather than the older SSL protocol, but the old name stuck. Your host, your designer and most help articles will still call it SSL, and they all mean the same thing.
Why it matters even for a simple brochure site
Chrome and other browsers flag pages without HTTPS as “Not secure”, right in the address bar. For a clinic or a law firm asking people to share personal details, that label undoes a lot of careful design. Google also confirmed years ago that HTTPS is a lightweight ranking signal. It won’t lift a weak page, but missing it is an easy own goal.
Some browser features, like location access and certain payment tools, only work over HTTPS at all.
Getting one and keeping it working
Free certificates from services like Let’s Encrypt are trusted by every major browser and are fine for almost every small business. Most hosts and builders issue and renew them automatically. Once it’s on, check three things:
- Every
http://address redirects tohttps://with a 301 redirect. - Images and scripts load over HTTPS too, or the padlock breaks.
- Renewal is automatic, so the certificate never quietly expires.
If you change hosts or point your domain somewhere new, confirm the certificate is issued for the new setup before you switch, so visitors never see a warning page in between.
What I’d do
Nick Lovett, founder of Tavro
Every site I launch is HTTPS only, with the certificate renewing on its own and old addresses redirected. It’s not something you should have to think about. If you’re seeing “Not secure” on your current site, it’s usually a quick fix: turn on the host’s free certificate, add the redirect and update any hard-coded image links. If your host wants to charge a premium for a basic certificate, that tells me it may be time to look at a different host.
Follow-up questions
For encryption, yes. Paid certificates add things like extended validation or warranties that most small businesses don’t need.
Usually some images or scripts still load over http, or the http version doesn’t redirect. Both are fixable in the site or host settings.
Not in any way a visitor would notice. Modern HTTPS is fast, and some speed features only work over it.
Keep reading
- nick@tavro.ca
- 587-439-9994
- Calgary, Alberta