What is an SSL certificate? It is a small digital file installed on your web server that proves your website’s identity and lets visitors’ browsers connect to it over an encrypted link. When it is working, your address starts with https:// and browsers show a padlock instead of a “Not secure” warning.
Every website needs one in 2026, including simple brochure sites that never take payments. This guide explains how SSL works in plain English, which type you need, whether free certificates are good enough, and how to fix the most common problems.
What is an SSL certificate and how does it work?
SSL stands for Secure Sockets Layer. The original SSL protocol was retired years ago and replaced by TLS (Transport Layer Security), but the name stuck. When people say “SSL certificate” today, they mean a certificate used for TLS.
Here is what happens, simplified, each time someone visits your site over HTTPS:
- The visitor’s browser asks your server to prove who it is.
- Your server sends its certificate, which was issued by a trusted certificate authority (CA).
- The browser checks that the certificate is valid, unexpired and issued for your exact domain.
- Browser and server agree on encryption keys, and everything sent between them is encrypted.
This takes a fraction of a second. The result is that nobody between your visitor and your server, such as someone on the same public Wi-Fi, can read or change what is being sent.
The padlock, HTTPS and what visitors see
HTTPS is simply HTTP (the language browsers use to load pages) running over a TLS-encrypted connection. Your SSL certificate is what makes HTTPS possible.
Visitors notice the difference straight away:
- With a valid certificate: the address shows https:// and a padlock or similar secure icon.
- Without one: Chrome, Safari, Firefox and Edge mark the page as “Not secure”, especially on pages with forms.
- With a broken or expired certificate: many browsers show a full-page warning that most people will not click past.
That last case is the most damaging. An expired certificate can make your site look abandoned or unsafe overnight.
Why an SSL certificate matters for your business
Trust
People have learned to look for the padlock. A “Not secure” label next to your business name makes visitors hesitate, even if your site only shows a menu or opening hours.
Google rankings
Google has used HTTPS as a ranking signal for years. It is a light signal on its own, but there is no good reason to give it away, and Chrome’s warnings on HTTP pages hurt engagement too.
Forms, logins and payments
Any time a visitor types something, whether a contact message, password or card number, it should travel encrypted. Payment providers require HTTPS, and many modern browser features only work on secure pages.
Protecting your own logins
When you log in to your WordPress dashboard over HTTP on public Wi-Fi, your password can be intercepted. HTTPS closes that gap. It is one item on our WordPress security checklist for good reason.
Types of SSL certificates: DV, OV and EV
All SSL certificates encrypt traffic in the same way. The difference between types is how much the certificate authority checks about who you are before issuing it.
| Type | What is checked | Issued in | Best for |
|---|---|---|---|
| Domain Validated (DV) | That you control the domain | Minutes | Most websites, blogs, small business sites and online stores |
| Organization Validated (OV) | Domain control plus basic company details | Days | Companies that want business details inside the certificate |
| Extended Validation (EV) | Detailed legal and company checks | Days to weeks | Large organizations with compliance requirements |
A few years ago, EV certificates showed a green bar with the company name in the address bar. Modern browsers dropped that display, so most visitors cannot see the difference between DV and EV anymore.
You may also see wildcard certificates (covering *.yourdomain.com) and multi-domain certificates (covering several names at once). These describe coverage, not validation level.
Free vs paid SSL certificates
Let’s Encrypt is a non-profit certificate authority that issues free DV certificates, and it secures a huge share of the web. For most sites, a free certificate is the right choice.
Free Let’s Encrypt certificates give you:
- The same encryption strength as a paid DV certificate
- Trust in every major browser
- Automatic renewal every 90 days when your host supports it
A paid certificate makes sense when you specifically need OV or EV validation, a warranty from the issuer, or a contract requirement says so. If a host tries to charge you for a basic certificate, that is worth questioning. Our guide on how to choose a web hosting provider lists free SSL as a must-have.
How to fix “Not secure” warnings
If your browser still says “Not secure”, work through these checks in order.
1. Confirm a certificate is installed
Visit https://yourdomain.com directly. If you get a certificate error, the certificate is missing, expired, or issued for a different name (for example, it covers www but not the bare domain). Your hosting control panel should show the certificate status for each domain.
2. Check that your domain points to your host
Free certificates are issued automatically only when your domain resolves to the server. If you recently changed nameservers, give DNS time to update. See how to point your domain to your hosting.
3. Fix mixed content
Mixed content happens when an HTTPS page loads images, scripts, fonts or styles over plain HTTP. The browser may block those files or remove the padlock. To fix it:
- Open your browser’s developer tools and check the Console for “Mixed Content” messages.
- In WordPress, set both the WordPress Address and Site Address to https:// under Settings, General.
- Run a search-and-replace on your database to change old http://yourdomain.com links to https://yourdomain.com. Take a backup first.
- Update hard-coded http:// links in your theme, widgets or custom code.
4. Force HTTPS everywhere
Even with a valid certificate, visitors can still land on the HTTP version through old links. Add a permanent (301) redirect from HTTP to HTTPS. Many control panels have a “Force HTTPS” switch. On Apache or LiteSpeed servers, you can also add a rule to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
After forcing HTTPS, update your site address in Google Search Console and any marketing tools so they use the https:// version.
Keeping your SSL certificate renewed
Certificates expire by design. Let’s Encrypt certificates last 90 days, and the industry is moving towards shorter lifetimes for all certificates. That makes automatic renewal essential, because manual renewal is easy to forget.
Good practice for small businesses:
- Use a host that issues and renews certificates automatically.
- Make sure every name you use is covered: yourdomain.com, www.yourdomain.com and your mail hostname.
- Check the padlock on your site once a month, especially after DNS changes.
How HostRiser handles SSL
Every HostRiser plan includes free Let’s Encrypt SSL that is issued automatically when your domain points to us and renewed automatically before it expires. We check certificates hourly, and coverage includes mail.yourdomain.com so your email connections are encrypted too. You do not need to buy or install anything. See what else comes with each plan on our web hosting page.
Frequently asked questions
What is an SSL certificate in simple terms?
An SSL certificate is a small data file that proves your website is really yours and lets browsers set up an encrypted connection with it. When it is installed correctly, your site loads over HTTPS and shows a padlock in the address bar.
Is a free SSL certificate good enough?
For most websites, yes. A free Let’s Encrypt certificate uses the same strength of encryption as a paid domain-validated certificate and is trusted by all major browsers.
Why does my site say Not secure even though I have SSL?
Usually the site is still loading over HTTP, or some images, scripts or styles are loaded over HTTP, which is called mixed content. Force HTTPS for the whole site and update any http:// links to https://.
Does SSL help my Google rankings?
Google uses HTTPS as a lightweight ranking signal. The bigger benefit is that visitors trust your site and browsers do not show warnings that drive people away.
How long does an SSL certificate last?
Let’s Encrypt certificates last 90 days and are designed to renew automatically. Paid certificates have longer terms, but browsers now limit how long any single certificate can be valid.
Want SSL you never have to think about? Explore our hosting plans, all with free auto-renewing certificates included.
Last updated October 12, 2026
