Free SSL Isn’t Set and Forget for Small Businesses
Yes, you need SSL: enable HTTPS on every site you run. Chrome flags unencrypted pages, and payment rules such as PCI DSS expect encrypted connections. Free certificates from Let’s Encrypt make the cost close to zero, so the real job is making sure your host installs and renews the certificate automatically.
TL;DR:
- Sites with payments, logins, contact forms, or personal data need HTTPS; brochure sites also benefit from protection against tampering and browser warnings.
- A free Let’s Encrypt certificate provides the same encryption strength as a paid one; pay only if buyers require identity checks, warranties, or service guarantees.
- Ask your host or content delivery network to install certificates for both the main and www addresses, redirect HTTP permanently, and automate renewal.
- Let’s Encrypt plans to shorten certificate lifetimes to 64 days in 2027 and 45 days later, making automated renewal essential rather than calendar reminders.
- After a redesign or hosting move, check the HTTPS address, certificate expiry, and HTTP redirects, then use Chrome DevTools or Lighthouse to find mixed content.
Table of Contents
- What SSL/TLS is and how it protects your visitors
- Do you need SSL? A practical checklist
- What happens if you don’t use HTTPS
- Free vs paid SSL certificates
- How to get HTTPS and keep it working
- Signs it’s installed correctly, and quick fixes
- Why we build HTTPS and automated care into our websites
- How we can handle HTTPS for you
- FAQ
- Sources
What SSL/TLS is and how it protects your visitors
SSL stands for Secure Sockets Layer, an old protocol that has long been replaced by TLS, Transport Layer Security. People still say “SSL certificate” out of habit, and certificate sellers still use the term, so we use both names for the same thing.
A certificate binds a public key to your domain name. When a visitor connects, their browser checks that certificate and uses it to set up an encrypted session during the TLS handshake, as Keyfactor explains. Certificate authorities, the organisations that issue certificates, sit at the top of a trust chain that browsers already know about. If the chain checks out, the browser trusts that the site is who it claims to be.
That arrangement stops man-in-the-middle attacks, where someone on a shared Wi-Fi network or a compromised router reads or alters traffic between your visitor and your server. In practice HTTPS gives you three protections:
- Encryption: nobody along the route can read what your visitors send, such as form entries or passwords.
- Integrity: the page arrives as you published it, with no injected adverts or tampered scripts.
- Authentication: the visitor can confirm they reached your real domain, not an imitation.
Do you need SSL? A practical checklist
Some cases leave no room for debate. If your site takes card payments, offers logins or collects personal details through forms, HTTPS is mandatory. Payment standards such as PCI DSS expect encrypted connections, and running without one can look like a failure to apply basic technical safeguards.
A brochure site or a blog is different on paper, but it still benefits. HTTPS stops third parties modifying your pages in transit, keeps modern browser features and APIs working, and supports your search visibility. Work through this order:
- Does your site take payments or card details? HTTPS is a must.
- Does it have logins, account areas or contact and enquiry forms? HTTPS is a must.
- Does it collect any personal data, such as names, emails or phone numbers? HTTPS is a must.
- None of the above? HTTPS is still strongly recommended for integrity, visitor trust and search.
In short, nearly every business site lands on “must” by step two, because almost every site has a contact form.
What happens if you don’t use HTTPS
Browsers have moved on from rewarding secure sites with a flashy badge. Chrome dropped the prominent lock icon because encrypted traffic is now the expected default. That flips the signal: it is the missing encryption that gets noticed, with an unsecured page labelled as such in the address bar. A visitor about to fill in your enquiry form sees that label and may simply leave.
Search is affected too. Google confirmed years ago that it uses HTTPS as a ranking signal.
HTTPS is a confirmed Google ranking signal, a lightweight one, but a plain HTTP site starts a step behind for no good reason.
Weaker rankings plus a visible “not secure” label add up to fewer visits and fewer enquiries. Local firms that depend on a trickle of calls and contact forms feel that quickly. If you want to see how technical trust signals feed into discoverability more broadly, this piece on SEO and qualified leads is a useful read.
Free vs paid SSL certificates
For most small business sites, a free Domain Validated (DV) certificate from Let’s Encrypt gives the same encryption strength as a paid one. The difference lies in what surrounds the certificate, not in how well it scrambles data. A paid option makes sense only when you specifically need one of these:
- Organisation Validation (OV) or Extended Validation (EV): the issuer vets your legal entity, which some enterprise or regulated buyers ask for.
- Warranties: a paid certificate may carry insurance-style cover from the seller.
- Enterprise service levels: guaranteed support response times, which matter for large, complex estates.
A local plumber, a salon or a consultancy rarely needs any of that, and paying for a certificate that nobody checks is money better spent elsewhere.
Pro Tip: Choose the provider that automates renewal, not the one with the fancier certificate. The failure that hurts small businesses is an expired certificate, and a forgotten paid certificate is less safe than an automated free one.
How to get HTTPS and keep it working
You have three realistic routes: your host or managed provider turns it on, a content delivery network (CDN) handles it at the edge, or you run Let’s Encrypt yourself through the ACME protocol. Hosted automation is the least effort, because someone else owns the renewal schedule. Chrome’s guidance says all sites should use HTTPS, and points to Let’s Encrypt or a CDN as easy ways to start. Whichever you pick, follow this sequence:
- Obtain the certificate through your host, CDN or an ACME client.
- Install it on the server for your main domain and the
wwwversion. - Add a permanent redirect from HTTP to HTTPS. Without the redirect, visitors can still reach the unencrypted site, your SEO authority splits between two versions and browsers may warn.
- Update canonical tags, sitemaps and internal links so they point to the HTTPS address.
- Test with Lighthouse and the Chrome DevTools Security panel to catch mixed content, where an HTTPS page still loads an image or script over HTTP.
- Confirm renewal is automated, and ask who gets alerted if it fails.
Step six matters more every year. Certificate lifetimes are shrinking: Let’s Encrypt is moving to 64-day certificates in 2027 and has outlined plans for 45 days after that. Its own explanation says automation is the point: silent expiry is the main way HTTPS breaks, so renewals should never rely on a calendar reminder.
Pro Tip: Ask your provider in writing: “Is certificate renewal automatic, and who is alerted if it fails?” A clear answer is a good sign.
Signs it’s installed correctly, and quick fixes
You can verify a healthy setup in a few minutes without any technical background. These checks cover the usual ground:
- In the browser: the address starts with
https://and no warning appears. Click the site information icon beside the address to view certificate details and the expiry date. - In Chrome DevTools: open the Security panel to spot mixed content, an expired certificate or other HTTPS faults. A Lighthouse audit flags pages that fail to use HTTPS.
- The fixes: renew an expired certificate, force the HTTP to HTTPS redirect, swap any
http://images or scripts for secure versions and update old internal links.
Run these checks after any redesign or hosting move, since those are the moments when redirects and certificates tend to get lost. Our website maintenance checklist covers the other routine checks worth scheduling alongside it.
Why we build HTTPS and automated care into our websites
I have built affordable, enquiry-focused websites for small businesses for long enough to see the same pattern: owners worry about the type of certificate, then lose a weekend of enquiries because one quietly expired. The certificate is rarely the weak link. The renewal process is. With lifetimes getting shorter, a care plan can help you focus on running your business instead of managing your website.
— niall
How we can handle HTTPS for you
Our website care plans cover hosting and technical upkeep. Website Care is €29 per month, Business Growth Care is €49 per month and Website Care + SEO Growth is €99 per month, all listed on our pricing page. You can see what each service includes on our services page or read how the process works on our how it works page. If you would rather not think about certificates at all, check the plans and get in touch.
FAQ
Do I need SSL on my website if I don’t sell anything?
Yes, it is still strongly recommended. HTTPS protects the contact forms and pages you do have, stops tampering in transit and avoids the unsecured label in Chrome. It also supports your search visibility.
What is the difference between SSL and TLS?
TLS is the modern, secure successor to SSL. People keep saying “SSL certificate” out of habit, but the certificate you install today works with TLS.
Where can I get a free SSL certificate for my domain?
Let’s Encrypt issues free Domain Validated certificates, and many hosts and CDNs install them for you automatically. Ask your provider first, because it is usually a single setting.
What happens if my SSL certificate expires?
Browsers show a full-page security warning, and most visitors will not click through it. Automatic renewal, as part of your hosting or care plan, is the way to prevent it.