What an SSL certificate does
A certificate is a digital file that proves your site is the one tied to your domain and enables encryption. Technically the modern protocol is called TLS, but everyone still says SSL. When it is installed, your pages load at addresses beginning with https instead of http.
Encryption stops people on the same public network from reading or changing what passes between the visitor and your server. It does not by itself prove your business is trustworthy, only that the connection is private and the domain is correct.
Getting a certificate
Most hosts and site builders issue free certificates automatically, often through a nonprofit authority such as Let's Encrypt. Look in your hosting control panel for an SSL or security section and turn on the option for your domain. Paid certificates exist, with extra validation levels or warranty terms, but a standard free one is enough for most small sites.
The certificate must cover every address people use, such as the bare domain and the www version. Wildcard certificates cover subdomains as well.
Force HTTPS everywhere
Installing a certificate is not enough. You also need to redirect every http address to its https twin, so that nobody lands on the unprotected version. Set this up in your host settings, a plugin, or your server rules, then test by typing the http address into a browser.
Update internal links, your sitemap, canonical tags, Google Business Profile website link and analytics property to the https version. Search Console should have the https property verified.
Why certificates expire and how to avoid it
Certificates are issued for limited periods, from a few months to about a year. Free ones typically renew automatically every couple of months, but the renewal can fail if DNS changed, the server blocks the verification request, or a security plugin interferes. An expired certificate puts a full-page warning in front of visitors.
Check your site monthly. Many uptime monitoring tools also watch for certificate expiry and email you before it lapses.
When the padlock shows a warning
If the lock is missing or marked not secure, the likely cause is mixed content, where the page is https but loads an image or script over http. Other causes are an expired certificate, a certificate for the wrong name, or a misconfigured redirect loop.
Click the warning icon in the address bar for details and use the browser's developer console to see which files load insecurely. Our guide on fixing mixed content walks through that step.
A short monthly check
On the first of each month, open your site in a private window using both the www and non-www versions, and the http version. All three should end up on the same secure address with a padlock. Click the padlock to view the certificate and note the expiry date.
If you use a separate booking or store subdomain, check it as well. Certificates are issued per name, and a subdomain handled by another service may have its own renewal schedule.
Common questions
Is a free SSL certificate less secure than a paid one?
The encryption strength is the same. Paid options may add validation levels or support, not stronger encryption.
Does HTTPS help SEO?
It is a lightweight ranking signal and it avoids browser warnings that drive visitors away.
Do I need SSL if I do not sell anything?
Yes. Contact forms, logins and general trust all benefit, and browsers flag unencrypted sites.
This guide is general information. Search engines change how they work and their guidelines; check Google's current documentation for your situation. Nobody can guarantee a ranking.