An SSL certificate for your website enables HTTPS, which encrypts data between visitors and your site and removes the "Not secure" warning. Free certificates from Let's Encrypt suit most small businesses; they last 90 days and should renew automatically about every 60 days. Most problems come from failed renewals or mixed content.
Key Takeaways
- Every website needs HTTPS, not only shops; browsers warn visitors on pages without it.
- Let's Encrypt certificates are free and suit most small business websites.
- Let's Encrypt certificates last 90 days, so automatic renewal is essential.
- Mixed content, such as images loaded over plain HTTP, breaks the padlock.
- Paid certificates add organisation validation and support, not stronger encryption.
What Does an SSL Certificate for a Website Do?
When you see a padlock and https:// in the address bar, the connection between the visitor's browser and the website is encrypted. An SSL certificate for your website, more accurately called a TLS certificate today, makes that possible. It stops anyone between the visitor and your server, on public Wi-Fi for example, from reading or changing what is sent: form entries, passwords, order details. It also proves the visitor is talking to your domain and not an impostor.
Without HTTPS, browsers label pages "Not secure", which scares visitors away, especially on forms and checkouts. Certificates are also a search factor covered in our Google basics guide.
Free or Paid Certificate?
| Type | Cost | Validation | Suits |
|---|---|---|---|
| Let's Encrypt (domain validated) | Free | Proves control of the domain | Most small business sites and stores |
| Host-provided free certificate | Included with hosting | Usually domain validated | Same as above |
| Paid organisation validated | Annual fee | Also checks the organisation exists | Larger firms with specific policy needs |
The encryption strength is the same; paid certificates add identity checks, warranties and vendor support. Let's Encrypt's FAQ states its certificates are free, though some hosting providers may charge a small fee to cover their own costs of setting them up.
Why Do Certificates Expire and Renewals Fail?
Let's Encrypt certificates are valid for 90 days by default, and its FAQ recommends renewing every 60 days. Hosts and control panels normally renew automatically. Renewals fail when DNS has moved to another provider, the domain points to a different server, a firewall blocks the verification request, or a site was migrated and the old automation stopped. When that happens, visitors see a full-page browser warning, which is far worse than the old "Not secure" label. Set up an alert for certificate expiry; our uptime monitoring guide covers tools that check this.
What Is Mixed Content?
A page loaded over HTTPS that pulls in images, scripts or styles over plain HTTP has mixed content. Browsers may block those items or remove the padlock. It often appears after moving a site to HTTPS when old content still uses http:// links. Fix it by updating links in the database and theme, and check pages with the browser's developer console.
How Do You Move a Site to HTTPS Properly?
- Install the certificate and confirm the site loads on https://.
- Redirect every http:// address to its https:// version with permanent redirects.
- Update internal links, images and scripts to https://.
- Update the site address in your CMS settings.
- Add the HTTPS version to Google Search Console and check for errors.
Google's guidance on site moves applies, since the protocol change alters every URL; see our guide to changing websites without losing traffic.
Which Warnings Should Worry You?
- "Not secure" in the address bar: no HTTPS, or a page with a form loaded over HTTP.
- "Your connection is not private": expired, mismatched or invalid certificate; fix immediately.
- Padlock missing on some pages: mixed content on those pages.
How Can You Check Your Certificate Yourself?
Click the padlock in the browser address bar and open the certificate details. You will see who issued it, which domain names it covers and its expiry date. Check both the www and non-www versions of your address, and any subdomains such as shop.yourbusiness.pk, because a certificate that covers one may not cover the others. Put the expiry date in a calendar as a backup to automatic alerts.
Why Does HTTPS Matter for Privacy?
Contact forms, logins and checkouts send personal data. Without HTTPS, that data travels unencrypted. HTTPS is a basic expectation of data protection rules in many countries.
How We Handle It
Every site we build, from Rs 40,500, uses HTTPS with automatic renewal, and our care plans from Rs 7,200 a month include expiry monitoring. Our security checklist lists the related basics. See our pricing page.
See also How to Transfer Your Domain Name to a New Registrar Without .
Frequently Asked Questions
- Let's Encrypt — FAQ
- MDN Web Docs — Mixed content
- Google Search Central — HTTPS as a ranking signal
- Google Search Central — Site moves with URL changes
How we researched this: Certificate lifetime (90 days), renewal advice (every 60 days) and the free status come from Let's Encrypt's FAQ, checked 30 October 2026. The free versus paid table and warnings list are editorial. Our prices come from the published list.
Seeing a Not secure warning?
Message us on WhatsApp for a fixed quote, or see our published pricing first.