Modern server rack with blue lighting in a secure data center environment.

3 November 2026Updated 3 November 2026

SSL Certificates and HTTPS Explained for Business Owners

“The padlock’s there, so we’re fine, aren’t we?” Mostly, yes. HTTPS is close to universal now, and Google’s own Chrome figures have had it on the large majority of page loads for years. But the padlock gets credit for far more than it actually does, and the jobs around it are where sites quietly come unstuck. Renewals. Redirects. The odd image still loading over plain HTTP. Picture a roofing firm whose certificate lapsed over a bank holiday weekend. Nobody’s hacked anything. There’s just a browser warning sitting between every visitor and the phone number.

In brief

HTTPS stops people on the network reading or meddling with what passes between your site and a visitor. It doesn’t vouch for you.
Every page should use it, and the ICO treats pages where people enter information as the bare minimum.
Certificate lifetimes are being cut hard, so renewal has to be automatic and somebody has to get the alert when it fails.
Switching from HTTP to HTTPS is a site move in Google’s eyes, so the redirects matter.

What HTTPS actually protects

SSL is the old name. The protocol doing the work today is TLS, and the ICO’s encryption guidance goes as far as saying a public-facing site shouldn’t support any version of SSL at all. Everyone still calls it an ‘SSL certificate’, hosts included, so don’t get hung up on the label.

The certificate lets a visitor’s browser set up an encrypted connection with your server. That buys you two things. Nobody sat in the middle can quietly listen in. And the page can’t be fiddled with on its way through, which is the half people forget. Without HTTPS, anything along the route can alter a page on its way to the visitor, and Google’s web.dev team even mentions internet providers injecting ads into pages.

So does a simple brochure site need it? Yes. web.dev calls the idea that only sensitive sites need HTTPS a common misconception, because even harmless-looking browsing can give away a lot about a person. The ICO goes further. Its encryption guidance says you should have HTTPS across your entire site, and that pages where people enter information must be protected at the very least. Think of a physio clinic’s booking form. Names, phone numbers, sometimes a line about the injury. None of that should travel in the clear.

What the padlock doesn’t tell anyone

HTTPS shows the connection is encrypted and that the browser is talking to the domain in the address bar. Whether the business behind that domain is honest is another question entirely. A scam site can get a certificate just as easily as you can.

Google made much the same point in 2023, when it announced it was replacing the padlock in Chrome with a more neutral icon. Its reasoning was that many people misread the padlock as a sign a site could be trusted, when nearly all phishing sites use HTTPS. So the certificate keeps browsers off your back. Earning a visitor’s trust is a separate job, done by real contact details, proper reviews and a site that’s clearly cared for.

Don’t expect a rankings boost from it either. Google’s page experience documentation lists secure serving among the things to check, but it also says that beyond Core Web Vitals those aspects don’t directly help a site rank higher. The reason to get HTTPS right is the people using your site.

The browser warnings that cost you enquiries

Warnings are where a missing or broken certificate really bites. Chrome has marked plain HTTP pages as ‘not secure’ since July 2018. That’s in the address bar, right next to your web address.

Google has pushed harder since. Chrome 154, released in September 2026, now warns people by default before it connects to a site over plain HTTP. Google trailed the change back in October 2025 and said sites people visit regularly wouldn’t keep setting the warning off. For a bed and breakfast still running on plain HTTP, that’s one more screen to click through before anyone sees a room.

An expired or badly set-up certificate is worse. The visitor gets a full-page error saying the connection isn’t private, and it’s a fair bet a lot of them simply leave. Search Console’s HTTPS report flags an invalid certificate too, and Google notes it usually affects the whole site at once.

Renewals are about to get far more frequent

Certificates expire. In April 2025 the CA/Browser Forum, the group that sets the rules for publicly trusted certificates, passed a ballot to cut the maximum lifetime in stages from 398 days to 47. The schedule began in March 2026 and runs to March 2029.

Anyone renewing by hand once a year is going to get caught out. Automatic renewal is what you want. The bit people miss is checking it’s actually switched on, and knowing whose inbox the failure email lands in. On a budget plan that might be an address nobody’s opened since launch day. It’s one of the questions we’d put to any provider, alongside the others in our comparison of cheap and managed hosting for business sites. Certificates are only one part of the routine upkeep in our full guide to website security and maintenance, which covers backups, logins and domain renewals as well.

Moving an older site from HTTP to HTTPS

Most sites made the switch years ago. If yours hasn’t, or someone rushed it, know that Google treats a change from HTTP to HTTPS as a site move with URL changes. Every address on the site changes, even if the pages look identical.

Google’s site move guidance asks for the same things as any migration. Permanent server-side redirects from each old HTTP address to its HTTPS twin. Internal links updated to the new addresses. Sitemaps that list the HTTPS versions, and a self-referencing canonical tag on each page. When a page exists at both addresses, Google’s Search Console help says it prefers to index the HTTPS one, but you shouldn’t leave that to chance. The same discipline applies to bigger rebuilds, which we cover in moving to a new website without losing your rankings. If you’d rather hand the redirect mapping over, that’s part of our SEO-safe site migration work.

Afterwards, open the HTTPS report in Search Console. It shows how many indexed pages are still on HTTP and why. Usual suspects include a sitemap still pointing at HTTP addresses, an HTTP page whose canonical tag names itself, or an HTTPS page that redirects back to HTTP.

Mixed content and the finishing touches

Mixed content is a secure page pulling something in over plain HTTP. An old logo hard-coded with an http:// address, say, or the script behind a booking widget. MDN’s documentation explains that browsers will try to upgrade ordinary images to HTTPS automatically, but block scripts, stylesheets, iframes and web fonts outright. Images set up to swap size for different screens don’t get upgraded either. That’s how a charity’s donate button can vanish after a move, or a form can stop sending for no obvious reason. Our piece on contact forms that work properly goes through the other ways enquiries go missing.

Once everything’s clean there’s HSTS, a header telling browsers to use HTTPS for your site every time from then on. MDN flags a catch. With HSTS in place, the browser won’t let a visitor click past a certificate error at all. Switch it on only once renewals are reliable, or one expired certificate shuts out returning visitors until it’s fixed.

A five-minute check you can do today

Type your address starting with http:// and make sure it lands on the https:// version.
Try it with and without the www.
Click the icon to the left of the address bar and check the certificate shows as valid.
Have a look at the HTTPS report in Search Console.
Ask your host who gets told when a renewal fails.

Getting it looked after

None of this needs a big project. On most sites it’s a morning of checks and maybe a couple of fixes. We handle certificates, redirects and renewals as part of our managed website hosting, and a website care plan adds the regular checks on top. Not sure what state yours is in? Get in touch and we’ll have a look.

Keep reading

Sources

Scott Woodfield

Founder of TWA. Scott has spent 17 years in web design and digital marketing, nine of them inside agencies and eight running his own practice. He plans, designs and builds the sites himself, from single landing pages to full ecommerce builds, and he's the person you speak to when you call.

Let’s have a chat