What is an SSL certificate — and why Google warns your customers

Open your website in your browser and look at the address bar. Do you see a little padlock next to your web address, or a warning that says "Not secure"? That tiny detail has a bigger impact on your business than you might think — and it's the visible sign of something called SSL.

SSL is one of those topics wrapped in jargon and, sadly, in upselling. Some hosts and designers still try to charge £100 a year for it. The truth is far simpler and cheaper. This guide explains what SSL is, why it matters, why Google makes a fuss about it, and how to get it for free.

The short answer

SSL (Secure Sockets Layer) is the technology that puts the padlock in your browser and the "https" in your web address. It encrypts the data travelling between your visitor's browser and your website so it can't be intercepted. Every website needs it in 2026 — without it, browsers warn visitors that your site is "Not secure," and Google ranks you lower.

And here's the part most people don't know: SSL is free. A service called Let's Encrypt provides it at no cost, and any decent host sets it up for you. If you're paying for an SSL certificate, you're probably being overcharged.

What SSL actually does

When someone visits your website, information travels between their device and your server — the pages they request, anything they type into a form, and so on. Without SSL, that data travels in plain text. In theory, someone snooping on the connection could read it.

SSL encrypts that data, scrambling it so only the visitor's browser and your server can read it. The padlock is the browser's way of telling the visitor "this connection is encrypted and safe."

For most small business sites — where visitors are browsing or filling in a contact form — the practical risk of not having SSL is small. But here's the thing: Google and the browsers treat it as essential regardless, which makes it essential for you.

Why the "Not secure" warning matters

Modern browsers like Chrome don't just quietly allow non-SSL sites — they actively warn about them. If your site doesn't have SSL, visitors see a "Not secure" label next to your address. On some pages, they get a full-screen warning telling them the site isn't secure and asking if they really want to continue.

Put yourself in a customer's shoes. You click through to a plumber's website and your browser tells you it's "Not secure." Do you fill in their contact form? Do you trust them with your details? Most people don't. They back out and find a competitor whose site shows the padlock.

So the warning isn't just cosmetic — it actively costs you customers. See the other reasons visitors abandon sites.

SSL and your Google rankings

Google has confirmed that HTTPS (having SSL) is a ranking signal. Sites without it rank lower, all else being equal. It's not the biggest factor, but it's a real one — and it's the easiest SEO box to tick because it's free.

More importantly, Google's Chrome browser flags non-SSL sites, which means visitors leave — and high bounce rates hurt your rankings indirectly too. See how SEO works. Getting SSL is a no-brainer win on multiple fronts.

SSL should be free (and usually is)

Here's where a lot of small businesses get overcharged. For years, SSL certificates were sold by certificate authorities for £50–£200 a year, and some hosts and designers still push this model. But in 2026, there's no good reason to pay those prices.

A non-profit called Let's Encrypt provides SSL certificates completely free, and they're recognised and trusted by all major browsers. Any reputable hosting provider will set up and renew a Let's Encrypt certificate for you at no extra cost — it's often a single checkbox in your hosting control panel.

So if anyone quotes you £100 a year for an SSL certificate, ask why. The answer is almost always "because that's what we've always charged," not because you're getting anything the free version doesn't provide. See what you should and shouldn't pay for.

Are there times a paid certificate makes sense?

Honestly, rarely for a small business. The expensive certificates (called "EV" or "OV" certificates) historically showed your company name in the browser, which looked more official. But most browsers have stopped displaying that prominently, so the visible benefit is largely gone. For 99% of small business sites, a free Let's Encrypt certificate does exactly the same job.

The exception might be very large e-commerce operations or enterprises with specific compliance needs — not your local plumber, florist, or solicitor.

How to check if your site has SSL

It takes five seconds:

1. Open your website in Chrome or another modern browser.
2. Look at the address bar. If you see a padlock (or the "https://" before your domain), you have SSL.
3. If you see "Not secure" or "http://" (without the "s"), you don't.

Check every page, not just the homepage — sometimes sites are configured inconsistently, with some pages secure and others not.

How to get SSL on your site

If you don't have it, here's what to do:

• Check your hosting control panel. Most modern hosts (cPanel, etc.) have a one-click option to enable a free Let's Encrypt certificate. Look for "SSL/TLS" or "Let's Encrypt."
• Ask your host. If you can't find it, email your hosting provider and ask them to enable a free SSL certificate. Reputable hosts do this without question.
• Ask your web designer. If someone manages your site for you, they should sort this — ideally without charging you, since it's free.
• Set up auto-renewal. SSL certificates expire (Let's Encrypt's every 90 days, but good hosts auto-renew). Make sure this is automated so you don't get caught out.

Once SSL is active, make sure your site forces visitors to the secure "https://" version — not the old "http://" one. Your host or designer can set this up with a "redirect."

"Mixed content" — a common gotcha

One thing that trips people up: you can have SSL enabled, but if some images or elements on your page still load from the old insecure "http://" addresses, browsers will show a warning anyway. This is called "mixed content." It usually happens when a site is moved to SSL but the internal links aren't updated.

If your browser shows a warning despite your site supposedly having SSL, mixed content is the likely culprit. A developer can fix it quickly — it's a routine job.

SSL is necessary, not sufficient

A quick note of perspective. SSL is essential — but having it doesn't mean your site is "secure" in any deep sense. It just means the connection is encrypted. Real website security involves more: strong passwords, updated software, backups, good hosting. Read our no-scare security guide.

Think of SSL as the lock on your front door — necessary, but not the whole security system.

Common SSL myths

• "SSL is only for sites that take payments." Wrong. Every site needs it now — browsers warn about all non-SSL sites.
• "Free SSL isn't as good as paid." Wrong. Let's Encrypt certificates provide the same encryption. The encryption doesn't know what you paid.
• "SSL makes my site slow." Negligibly. Modern SSL has no meaningful performance impact.
• "Once it's set up, I'm done forever." Mostly, but certificates expire. Make sure auto-renewal is on. See our maintenance checklist.

How we handle SSL

At PulseCreate, every website we build comes with free SSL set up and auto-renewing from day one — no extra charge, ever. It's part of building a website properly. Our optional £50/month hosting includes SSL, backups, updates, and monitoring as standard.

Our fixed-price build is £1,495. If your current site is showing "Not secure" and scaring off visitors, let's talk — or get a free homepage demo to see what a properly built site looks like.

The bottom line

SSL is the padlock that tells visitors your site is safe, and it's non-negotiable in 2026. Without it, browsers warn your customers away and Google ranks you lower. With it — and it should be free via Let's Encrypt — you build trust and tick an easy SEO box. Check your site today. If it's "Not secure," get it fixed this week. There's no good reason not to, and no good reason to pay £100 a year for the privilege.

Written by Ryan Vessey — founder of PulseCreate, a web design studio in Horsham, West Sussex. I build fast, secure, search-ready websites for UK small businesses at a fixed £1,495. More about me →