An SSL/TLS certificate lets a browser open an encrypted HTTPS connection to your server and check that the certificate belongs to the name in the address bar. “SSL” is the old label; current systems use TLS, and the name stuck. If your site still loads over plain HTTP, visitors see a “Not secure” warning and anything they type can be read on the way.
What a certificate provides
- Encryption in transit: passwords, cookies and form data cannot be read by others on the path.
- Integrity: changes made to the page on the way are detectable.
- Identity of the name: a certificate authority has verified control of the domain, and at higher tiers the organisation as well.
HTTPS is simply HTTP running inside that secure channel. A certificate that does not match the hostname, or has expired, makes browsers block or warn, because the trust check failed.
Why leave HTTP behind
- Browser warnings push visitors away before they read your offer.
- Logins, checkouts and contact forms expose data on shared networks over HTTP.
- Modern features such as secure cookies, service workers and many APIs require HTTPS.
- Payment providers and partners treat HTTPS as the minimum.
HTTPS protects the connection, not a vulnerable plugin. Updates and strong passwords are still needed.
Switching to HTTPS
- Get a certificate that covers every name visitors use: the bare domain,
wwwand needed subdomains. - Install the certificate with its full chain and redirect HTTP to your preferred HTTPS address with a 301.
- Fix mixed content: images, scripts and styles still loaded over
http://on an HTTPS page. - Update canonical tags, the sitemap and internal links to the HTTPS address.
- Monitor expiry. Certificates now have short lifetimes, so rely on automatic renewal and a reminder you control.
Certificates are available on the SSL certificates page and are used on web hosting. To choose between certificate types, see DV, OV and EV for an online shop and Let’s Encrypt vs paid SSL.
Frequently asked questions
Is SSL the same as HTTPS?
They are related. The certificate and TLS secure the channel; HTTPS is HTTP running over it.
Is a free certificate enough?
For encryption and the padlock, yes, if it is valid for the hostname and installed correctly. Higher tiers add organisation details.
Does HTTPS make my site secure?
It protects data in transit. Updates, access control and application hardening are separate work.
What happens when a certificate expires?
Browsers show a full-page warning. Automatic renewal and monitoring prevent it.
