SSL Certificates Explained: HTTP vs HTTPS

When you open a website, you see either a padlock or a "Not secure" warning next to the address. The difference comes down to one thing: an SSL certificate. Here is what it does, why it is mandatory today, and what it should cost.

What SSL actually does

Without SSL, everything a visitor sends to your site travels as plain text — passwords, contact form messages, card numbers. Anyone intercepting that traffic (trivial on public Wi-Fi) can read it. SSL encrypts the connection between browser and server, turning intercepted data into unreadable noise. That is what produces https instead of http, and the padlock in the address bar.

Why it is mandatory, even for "simple" sites

• Google requires it. HTTPS has been a confirmed ranking factor since 2014, and Chrome openly flags sites without it as not secure.
• Customer trust. A "Not secure" warning drives visitors away before they read your first sentence.
• A contact form is reason enough. The moment you collect a name and email, you process personal data — and the law expects reasonable protection.
• Analytics. Without https you lose part of your referral data in Google Analytics.

What should SSL cost?

This is the important part: for most sites, nothing. Let''s Encrypt issues free certificates that are technically as strong as paid ones, and serious hosting providers issue and renew them automatically. If someone charges you €30-60 a year for a basic DV certificate, you are paying for something that should be included — with us it is, on every plan.

Paid certificates (OV/EV) only make sense for banks, large retailers and institutions that need verified legal identity. For 95% of websites, a free DV certificate is exactly right.

The most common problem after switching: mixed content

You enable SSL, but the padlock does not appear or shows a warning. The cause is almost always mixed content: the page loads over https, but an image or script still uses an http address. The fix: search the database and replace "http://yourdomain" with "https://yourdomain" (plugins do this in two clicks), then re-check.

What to do today

Open your site and look at the address bar. No padlock? Check whether SSL is enabled in your hosting panel — with a good provider it is one click or already active. Then set all http traffic to redirect automatically to https, so visitors never land on the insecure version.