What is an SSL certificate?
By Tom · Last reviewed · 4 minute read
An SSL certificate is a digital certificate that encrypts the data passing between your website and its visitors. It enables HTTPS and the padlock icon in the browser's address bar, and it stops passwords, contact form messages and payment details from being intercepted. Every business website needs one for security, trust and SEO.
On this page
Why your website needs SSL
Every business website should have SSL, and free certificates are easy to get. Google's own figures show that the vast majority of pages loaded in Chrome now use HTTPS.
Protects sensitive data
SSL encryption means personal information, passwords and payment details can't be intercepted as they travel between your website and your visitors.
Builds visitor trust
The padlock tells visitors your site is secure. Websites without SSL display 'Not secure' warnings, which put many people off filling in a form or making a purchase.
Helps your SEO
Google has confirmed HTTPS as a ranking signal. It isn't the biggest factor, but it's considered a basic requirement for modern SEO.
Enables modern features
Many modern web features only work over HTTPS, including location access, camera access, push notifications and Progressive Web Apps (PWAs).
UK GDPR
UK GDPR requires 'appropriate security measures' for personal data. SSL encryption is considered a basic security measure for any website that handles visitors' personal details.
Prevents browser warnings
Chrome, Firefox and other browsers show 'Not secure' warnings on HTTP sites. These warnings put visitors off.
How SSL encryption works
- The browser asks for a secure connection. When someone visits your HTTPS website, their browser asks your server to identify itself and set up a secure connection.
- The server sends its certificate. Your server responds with its SSL certificate, which contains a public key and details of your website and the certificate authority that issued it.
- The browser checks the certificate. It confirms the certificate is valid, hasn't expired and was issued by a trusted certificate authority. If any of that fails, the browser shows a warning.
- An encrypted connection is set up. Once verified, the browser and server create an encrypted session. Everything sent is scrambled so only the intended recipient can read it, and the padlock appears.
Types of SSL certificates
Certificates come in different validation levels. For most UK small businesses, a free DV certificate is enough.
| Domain Validated (DV) | Organisation Validated (OV) | Extended Validation (EV) | |
|---|---|---|---|
| Typical cost | Free to £50 a year | £50 to £200 a year | £100 to £500+ a year |
| What's checked | Domain ownership only | Domain and organisation identity | Thorough business verification |
| Time to get one | Minutes to hours | 1 to 3 days | 1 to 2 weeks |
| Best for | Personal sites, blogs, small business websites | Business websites, online shops, organisations | Banks, large online shops, financial services |
| Notes | Padlock and HTTPS, quick to get | Company name in the certificate details | The most rigorous checks, suited to high-value transactions |
Tip: for most Welsh small businesses, a free Domain Validated certificate from Let's Encrypt does the job. All my hosting and care plans include SSL, which I install and renew automatically.
How to get SSL for your website
- Check whether you already have it. Visit your website and look for the padlock. If it's there and your address starts with https://, SSL is already installed.
- Ask your hosting provider. Most good hosts include free SSL. Ask them to switch it on, or look in your hosting control panel.
- Use Let's Encrypt if you need to. If your host doesn't offer free SSL, Let's Encrypt does. Tools like Certbot can automate the installation.
- Update your site's links. Once SSL is installed, make sure all internal links, images and other files use https:// addresses to avoid 'mixed content' warnings.
- Set up redirects. Make your site automatically send HTTP visitors to the HTTPS version, so everyone uses the secure connection.
- Update Google Search Console. Add the https:// version of your site to Google Search Console and submit your updated sitemap.
- Keep an eye on expiry. Certificates expire: Let's Encrypt certificates last 90 days, and paid certificates now have a maximum lifetime of around 200 days, which is set to shrink further. Use auto-renewal so your site never shows a security warning.
Common SSL issues and solutions
Mixed content warnings
Cause: your HTTPS page loads some files (images, scripts, stylesheets) over insecure HTTP.
Solution: update all internal addresses to https:// or use relative links, and check your content for hard-coded http:// links.
Certificate expired
Cause: every certificate has an expiry date.
Solution: switch on auto-renewal with your hosting provider or certificate authority, and check it's working.
Certificate name mismatch
Cause: the domain in the certificate doesn't match the one visitors are using (for example, www versus non-www).
Solution: make sure your certificate covers both the www and non-www versions, or redirect everyone to the version it covers.
'Not secure' despite having SSL
Cause: SSL is installed but the site isn't redirecting HTTP to HTTPS, or there's mixed content.
Solution: set up 301 redirects from HTTP to HTTPS, fix any mixed content and check SSL is configured properly.
SSL included with every site I build
Every website I build, and every care plan, includes an SSL certificate. I handle the installation, setup and renewal, so you never have to think about it. That covers:
- The SSL certificate itself
- Installation and proper HTTPS setup
- Redirects from HTTP to HTTPS
- Fixing any mixed content
- Automatic certificate renewal
- Monitoring and security, as part of the care plan
Questions people ask
Why do I need an SSL certificate for my website?
There are several reasons. Security: it encrypts sensitive data like contact form messages, logins and payment details. Trust: visitors see the padlock, while sites without SSL show 'Not secure' warnings that drive people away. SEO: Google uses HTTPS as a ranking signal. Compliance: UK GDPR requires appropriate security for personal data, and SSL is considered a basic requirement. Many modern browser features also only work over HTTPS.
What is the difference between HTTP and HTTPS?
HTTP (Hypertext Transfer Protocol) sends data as plain text, so anyone intercepting the connection can read it. HTTPS (HTTP Secure) uses SSL/TLS encryption to scramble the data so only the intended recipient can read it. You can spot HTTPS sites by the padlock icon and 'https://' at the start of the address. There's no good reason for a modern website to use unencrypted HTTP.
How much does an SSL certificate cost in the UK?
It depends on the type. Free certificates are available from Let's Encrypt and are included with most good hosting. Domain Validated (DV) certificates cost from nothing to about £50 a year and suit most small business websites. Organisation Validated (OV) certificates cost about £50 to £200 a year and verify your organisation's identity. Extended Validation (EV) certificates cost about £100 to £500 or more a year and involve the most thorough checks. For most UK small businesses, a free Let's Encrypt or basic DV certificate is enough.
What are the different types of SSL certificates?
There are three main validation levels. Domain Validated (DV) only checks that you own the domain; it's the quickest to get and suits most websites. Organisation Validated (OV) also checks your organisation's identity and shows the company name in the certificate details. Extended Validation (EV) involves the most thorough checks; it used to show the company name in the browser bar, but most browsers no longer do. There are also wildcard certificates (covering all subdomains) and multi-domain certificates (covering several domains with one certificate).
How do I know if a website has SSL?
Look at the browser's address bar. A secure site shows a padlock icon (click it for the certificate details), an address starting with 'https://' rather than 'http://', and no 'Not secure' warnings. If you see 'Not secure' or a warning triangle, the site either has no certificate or has one that has expired or is set up incorrectly.
What happens if my SSL certificate expires?
Browsers show alarming warnings telling visitors their connection isn't private. Most people leave straight away rather than carry on, which can badly hit your enquiries and sales, and search engines may drop your rankings for a while. Most hosting providers renew certificates automatically, but it's still worth checking that renewal is switched on and working.
Is SSL the same as TLS?
They're closely related. TLS (Transport Layer Security) is the newer, more secure successor to SSL (Secure Sockets Layer). People still say 'SSL certificate', but modern websites use TLS 1.2 or TLS 1.3. In practice the two terms are used interchangeably.
How do I get an SSL certificate for my website?
Most good hosting providers include a free certificate and install it automatically. If yours doesn't, Let's Encrypt is a free certificate authority that issues DV certificates at no cost. Commercial certificate authorities such as DigiCert and Sectigo sell paid certificates with extra validation. Or your web developer can set it up for you: every site I build and host has SSL included and configured properly.
Do SSL certificates affect website speed?
Modern SSL/TLS has very little effect on speed. The initial handshake adds a few milliseconds, which visitors won't notice. HTTPS also allows HTTP/2 and HTTP/3, newer protocols that can make your website faster. Any tiny slowdown is far outweighed by the security and SEO benefits.