What Is an SSL Certificate? HTTPS Explained for Site Owners

Look at the address bar of any reputable site you visit. You'll see https:// and a padlock. Look at a site without one and your browser will tell you, in increasingly aggressive language, that the connection is 'Not Secure.' That little padlock is an SSL certificate doing its job. Here's what it actually is, why your site needs one, and how to install it without overpaying.

What SSL actually does

SSL — and its modern successor, TLS — does two things: it encrypts the conversation between a visitor's browser and your server, and it proves to the browser that your server really is who it claims to be. Without SSL, anyone on the same coffee-shop Wi-Fi as your visitor can read passwords, credit card numbers, and form submissions in plain text. With SSL, the entire exchange is scrambled in transit and only the intended endpoints can read it.

The certificate part is the trust anchor. A certificate authority (CA) — a company browsers have decided to trust — issues your site a digital certificate that says 'I have verified that whoever runs example.com controls this server.' The browser checks the certificate, validates the chain, and only then shows the padlock.

Why every site needs HTTPS in 2026

Browsers now insist

Chrome, Safari, and Firefox all flag plain HTTP sites with prominent 'Not Secure' warnings. On pages that contain a password or payment form, the warning escalates to a full-page interstitial that most visitors will not click through. If you sell anything online without HTTPS, you're losing sales.

Search engines reward it

Google has confirmed HTTPS as a ranking signal since 2014. The boost is small in isolation, but compounded over thousands of pages it's a free improvement for sites that move to HTTPS correctly.

It unlocks modern features

Service workers, HTTP/2, geolocation, push notifications — almost every browser API introduced in the last decade requires HTTPS. Sticking with HTTP cuts you off from a steadily growing list of capabilities.

Free SSL vs paid SSL — what's the difference?

Free certificates from Let's Encrypt and other ACME providers are domain-validated (DV): the CA confirms you control the domain by asking you to place a file or DNS record. The encryption strength is identical to the most expensive enterprise certificate. For 95% of websites, free SSL is exactly what you need.

Paid certificates come in two extra flavours: organization-validated (OV), which puts your company name in the certificate after the CA verifies you exist as a business; and extended-validation (EV), which used to make the address bar turn green but now displays the same way as DV in modern browsers. Paid certs also typically include warranties (which almost no one ever claims), better support, and sometimes a security seal you can put on your site.

How to install SSL on your site

Option 1: Your hosting handles it (easiest)

Most modern shared hosting plans, including Maxinames, install and renew a free Let's Encrypt certificate automatically. You enable SSL in the control panel, the host requests the certificate, deploys it to your site, and renews it every 90 days without you doing anything. If your host doesn't offer this in 2026, switch hosts.

Option 2: A CDN in front of your site

Cloudflare, Fastly, and Bunny all offer free SSL termination at their edge. You point your domain at the CDN, the CDN serves HTTPS to your visitors, and your origin server can stay on HTTP (though you should still configure end-to-end encryption). This adds caching and DDoS protection as bonuses.

Option 3: Manage it yourself

On a VPS or dedicated server, you install certbot (or another ACME client), point it at your web server, and let it handle issuance and renewal. Five minutes of setup gets you automated certificates that renew forever.

Common pitfalls to avoid

• Mixed content. Once your site is on HTTPS, every image, script, and stylesheet must also load over HTTPS, or browsers will block the insecure resources and the padlock will turn into a warning.
• Forgetting to redirect HTTP to HTTPS. Visitors who type your address without https:// will land on the insecure version unless your server redirects them. A simple 301 redirect rule fixes it.
• Letting a certificate expire. With auto-renewal this should never happen, but if you manage manually, set a calendar reminder. An expired cert turns visitors away.
• Buying an expensive cert for a small site. The padlock is the same. Pay for the features that genuinely matter to you, not the brand on the certificate.

What to do this week

If your site is still on HTTP, the priority is clear: enable SSL today. Whether through your hosting control panel, a CDN, or certbot, the path is well-paved and free. Once it's live, audit for mixed content, set up the HTTP-to-HTTPS redirect, and cross one of the highest-leverage security improvements off your list permanently.