When a browser shows a padlock next to a web address, the site is using HTTPS, made possible by an SSL (more accurately TLS) certificate. Without one, browsers show a "Not secure" warning on pages that collect information.
What SSL protects
An SSL certificate encrypts data moving between the visitor and your server. That includes:
- Login usernames and passwords
- Contact and enquiry form submissions
- Payment and personal details
It also confirms the visitor is connected to the real site for your domain, not an impostor.
Types of certificate
Domain Validation (DV) confirms you control the domain. It is issued quickly and suits blogs and brochure sites.
Organisation Validation (OV) also verifies your company, adding a layer of trust for business websites.
Extended Validation (EV) involves the strictest company checks and is often used by financial and large e-commerce sites.
Wildcard certificates cover a domain and all its first-level subdomains.
HTTPS, trust and search
Google has said HTTPS is a lightweight ranking signal. More importantly, visitors are less likely to fill in a form on a page marked "Not secure". HTTPS is now a baseline expectation.
Checklist for moving to HTTPS
- Install the certificate on your hosting account
- Update your site's base URL to https://
- Redirect every HTTP URL to its HTTPS version with a 301 redirect
- Update internal links, images and scripts to use HTTPS to avoid mixed-content warnings
- Update canonical tags and your XML sitemap
- Add the HTTPS property in Google Search Console and submit the sitemap
Remember renewals
Certificates expire. Keep renewal reminders active, or your visitors will see a full-page security warning instead of your website.
Fixing mixed-content warnings
After switching to HTTPS, some pages may still show a warning because an image, script or stylesheet is loaded over plain HTTP. Common causes are:
- Hard-coded
http://links in old posts or theme files - Third-party widgets or embeds that still use HTTP
- Images inserted with a full HTTP URL in page builders
Use your browser's developer tools to find the insecure resources, then update them to HTTPS or to relative URLs. Once every resource loads securely, the padlock appears on every page.
Frequently asked questions
Is a free SSL certificate enough?
For many brochure sites a domain-validated certificate is enough to enable HTTPS. Businesses that want company details verified choose OV or EV certificates.
Will moving to HTTPS hurt my rankings?
Not if you use permanent 301 redirects from every HTTP URL, update internal links and canonicals, and submit the HTTPS sitemap.