SSL Certificates: What They Are and Why Your Site Needs One

You've probably noticed the small padlock icon that appears in your browser's address bar on some websites. You might have also noticed the warning message that appears on sites that don't have it: "Not Secure." That padlock — and the technology behind it — is an SSL certificate. Here's what it does, why it matters, and how to make sure your site has one.

What Is SSL?

SSL stands for Secure Sockets Layer. It's a technology that encrypts the connection between your website and the person visiting it. When SSL is active, any data that passes between the visitor's browser and your server — form submissions, login details, payment information — is scrambled so that nobody can intercept and read it.

Technically, SSL has been replaced by a newer version called TLS (Transport Layer Security), but everyone still calls it SSL. When you hear either term, they're referring to the same thing: the encryption that keeps data safe in transit.

A website with SSL enabled uses HTTPS in its web address (the "S" stands for "Secure") rather than plain HTTP.

Why Does It Matter?

Trust

When visitors see the padlock icon and HTTPS in their browser bar, it signals that your site is legitimate and that their data is protected. When they see "Not Secure," many will leave immediately. In a world where data breaches and online scams are regularly in the news, trust signals matter more than ever.

Google Rankings

Google has used HTTPS as a ranking signal since 2014. Sites without SSL are at a disadvantage in search results. It's not the biggest ranking factor, but it's one of the easiest to address. There's no good reason to give your competitors an edge by neglecting it.

Browser Warnings

Modern browsers — Chrome, Firefox, Safari, Edge — all flag non-HTTPS sites with visible warnings. Chrome in particular displays a prominent "Not Secure" label in the address bar. For a business website, that warning is devastating. It tells potential customers that you haven't taken basic steps to protect their information.

Legal and Compliance Requirements

If your website collects any personal data — even just a name and email address through a contact form — UK GDPR requires you to take appropriate measures to protect that data. SSL encryption is considered a baseline security measure. Operating without it could leave you exposed to regulatory issues.

Types of SSL Certificates

There are three main types, and the differences are about validation level rather than encryption strength. The encryption itself is the same across all three.

Domain Validated (DV)

The most basic type. The certificate authority simply checks that you own the domain. It's quick to issue, often within minutes, and it's the type provided by free services like Let's Encrypt.

Best for: Most small business websites, blogs, and portfolio sites.

Organisation Validated (OV)

The certificate authority verifies your organisation's identity as well as domain ownership. This takes a little longer and costs more, but it provides an extra layer of trust. Your organisation's details are included in the certificate, which visitors can inspect.

Best for: Businesses that want to demonstrate a higher level of credibility, particularly those handling sensitive customer information.

Extended Validation (EV)

The most thorough validation process. The certificate authority conducts detailed checks on your organisation before issuing the certificate. EV certificates used to display the company name in the browser bar, but most browsers have phased that out. They still provide the highest level of organisational verification.

Best for: Banks, financial institutions, and large e-commerce platforms. Most small businesses don't need this level.

How to Check If Your Site Has SSL

Open your website in a browser and look at the address bar:

Padlock icon and HTTPS: You're covered.
"Not Secure" warning and HTTP: You need an SSL certificate.
Padlock with a warning triangle: Your certificate may be expired or misconfigured.

You can also click on the padlock icon to see details about the certificate, including who issued it and when it expires.

How to Get an SSL Certificate

Free Options

Let's Encrypt is a free, automated certificate authority that provides DV certificates. Most modern hosting providers support it and can set it up with a single click.
AWS Certificate Manager (ACM) provides free SSL certificates for sites hosted on AWS infrastructure, including CloudFront. This is what we use for our clients' sites at SwiftCase Signal — it's automatically renewed and requires no manual intervention.
Cloudflare offers free SSL on its free plan, which can be added to any site regardless of where it's hosted.

Paid Options

If you need OV or EV certificates, providers like DigiCert, Sectigo, and GlobalSign offer them at varying price points, typically ranging from 50 to several hundred pounds per year.

Common Mistakes to Avoid

Letting your certificate expire. SSL certificates have expiry dates, usually every 90 days (Let's Encrypt) or annually (paid certificates). An expired certificate will trigger browser warnings. Set up auto-renewal wherever possible.
Mixed content. If your site loads some resources (images, scripts, stylesheets) over HTTP while the page itself is HTTPS, browsers will flag it. Make sure everything on your site uses HTTPS.
Not redirecting HTTP to HTTPS. Once you have SSL, set up a redirect so that anyone who visits the HTTP version of your site is automatically sent to the HTTPS version.

The Bottom Line

An SSL certificate is not optional in 2026. It's a basic requirement for any website that wants to be trusted by visitors, ranked by Google, and compliant with data protection regulations. The good news is that it's straightforward to set up and often completely free.

If you're not sure whether your site is properly secured, or if you need help getting SSL set up correctly, get in touch. It's a quick fix that makes a big difference.