SSL Certificate for a Website: Why You Need HTTPS and How to Switch
Seeing the "Not secure" label in the address bar, a visitor often closes the site without filling in the form. The reason is usually one: the site has no SSL certificate, or it is set up incorrectly. Let's look at what an SSL certificate and HTTPS are, how they protect a business, and how to properly move a site to a secure connection.
What are an SSL certificate and HTTPS
When a customer opens your site, their browser exchanges data with the server: pages, the name and phone from a form, a password, order details. In the ordinary HTTP protocol this data is sent in the clear - like a postcard that anyone it passes through can read.
HTTPS is the secure version of the protocol. The data is encrypted and becomes like a sealed envelope: even if an outsider intercepts it, they can't read the contents. For encryption, an SSL certificate is installed on the server. Technically, the TLS protocol is what is used today, but the name "SSL certificate" has stuck.
The certificate solves a second task too: it confirms to the browser that the site really belongs to this domain. That is why a site on HTTPS shows a padlock icon or a similar security indicator in the address bar.
Why a business needs HTTPS
Protecting customer data
If the site has a request form, registration or ordering, you receive customers' personal data. Sending it over an open channel is risky, especially when a person is connected to public Wi-Fi in a cafe or a shopping mall.
Trust and conversion
Modern browsers mark sites without HTTPS as "Not secure". For a customer this is an alarm signal: they won't leave a phone number or pay. Losing leads over a single technical setting is especially frustrating.
Search engines
Google has openly stated that it takes HTTPS into account as one of the ranking signals. It is not the only factor, but if competitors are secured and your site isn't, you are already a step behind.
Requirements of modern technologies
Many services work only over HTTPS: integration with payment systems, geolocation and browser notifications, the webhook address for a Telegram bot. All of this requires a secure connection.
Types of SSL certificates
| Type | What is verified | Who it suits |
|---|---|---|
| DV (domain validation) | Only the right to the domain | Most sites: business cards, corporate sites, blogs |
| OV (organization validation) | The domain and the company's existence | Sites where it matters to show company details |
| EV (extended validation) | In-depth check of company documents | Financial and other services with high trust requirements |
| Wildcard | The domain and all its subdomains | Projects with many subdomains |
The level of encryption is practically the same across these types; the difference is in the depth of verification and in the information stated in the certificate.
Free or paid certificate
Free DV certificates are widespread and for an ordinary company site are usually enough. Their validity period is typically shorter, so automatic renewal must be set up on the server. Paid certificates are chosen when you need organization validation, extended service terms or particular partner requirements. The choice is determined by the site's task.
How to switch a site to HTTPS
- Obtain and install the certificate. The certificate is issued by the hosting provider or on your server and linked to the domain.
- Set up the redirect. All http addresses lead to the https version through a permanent (301) redirect. The variants with and without www are also reduced to one main address.
- Fix mixed content. If a page is opened over HTTPS but images, scripts or fonts load over http, the browser will show a warning. All internal links and resource addresses are updated.
- Tell the search engines. The https version is added in Google Search Console and Yandex Webmaster, and the sitemap is updated.
- Turn on auto-renewal. The certificate must renew itself before it expires, and the process must be monitored.
- Final check. The site is opened in different browsers and on phones, and forms, payment and integrations are tested.
If you are ordering a new site, these steps should be a standard part of website development - clarify this in the commercial proposal.
How to check your site yourself
Even without technical knowledge, you can check the essentials in a few minutes:
- Open the site and look at the icon in the address bar: there should be a padlock or a security indicator, not the words "Not secure".
- Click the icon and see who the certificate was issued to and until what date it is valid.
- Type the address manually with http - the site should automatically switch to https.
- Check the variants of the address with and without www.
- Open several internal pages, especially those with forms and a cart - there should be no warnings.
- Repeat the check on a phone using mobile internet.
If you find a problem anywhere, tell the developer or hosting provider specifically: which page, which browser and what message appeared on the screen.
Common mistakes
- The certificate has expired. The browser shows a full-screen warning, and many visitors leave immediately.
- The http version stays available. Search engines see one site at two addresses.
- The certificate covers only the main domain. The www version or a subdomain stay unprotected.
- Mixed content. The padlock icon disappears, and some elements fail to load.
- Forms are sent to the old address. The page is secure, but the form data goes over http.
Does HTTPS protect against everything
No. HTTPS protects data in transit, but it doesn't save the site itself from being hacked. For full security you need strong passwords and, where possible, two-factor login to the admin panel, regular updates of the system and modules, backups, and limited access rights for employees. HTTPS is the first and mandatory step, but not the only one.
Frequently asked questions
Does a small business card site need an SSL certificate?
Yes. Even a single contact form collects customers' personal data. And the "Not secure" label works against the main task of a business card site - inspiring trust.
What happens if the certificate expires?
Browsers will start showing the site as dangerous, and many visitors won't be able to, or will be afraid to, enter it. That is why auto-renewal and monitoring the expiry date matter.
Does HTTPS slow a site down?
On modern servers and in modern browsers the effect of encryption is unnoticeable. On the contrary, many loading-speed technologies work only over HTTPS.
Does your site show "Not secure", or are you unsure the certificate is set up correctly? Leave a request or message UFLEX on Telegram - we'll check the site and help set up HTTPS properly.