You open your site on a phone that isn't yours and, next to the address, where you expect a padlock, the word «Not secure» shows up instead. The browser adds that label on its own, without warning you, whenever an SSL certificate is missing, and it scares people off more than it looks: plenty of them close the tab without reading a line. The good news is that it's usually one of the easiest and cheapest things on your whole site to fix.
What an SSL certificate is (and what the padlock means)
An SSL certificate is what encrypts the connection between the visitor's browser and your website. With it in place, everything typed along the way —an email in a form, a password, card details— travels scrambled rather than in the clear, and the address now starts with HTTPS. It's the difference between sending a letter in a sealed envelope and sending it on a postcard anyone who handles it can read; if you want the technical detail, MDN explains it well.
The browser padlock doesn't promise there's an honest company behind the site. It promises something more specific: that nobody along the way can read or change what's sent. That matters, because half the misunderstandings about what a certificate does come from missing it.
Why your browser says «Not secure»
For years now, Chrome, Safari and Firefox have flagged as «not secure» every site served over plain HTTP, without the S on the end. It isn't a punishment aimed at you: it's the default for any unencrypted page. The warning shows up for one of these reasons, and all of them can be fixed.
- There's no certificate. The site never had one.
- It has expired. It had one, nobody renewed it and one day it stopped being valid.
- It's set up wrong. It exists, but it doesn't cover the domain people actually use (for example, it covers yourdomain.com but not www.yourdomain.com).
- There's mixed content. The page runs over HTTPS but pulls in an image or a script over HTTP, and that breaks the padlock.
What you lose when your site shows up as not secure
The damage isn't theoretical, and it doesn't show up in any dashboard: it shows up in the people who arrive, read «Not secure» and leave.
The first thing you lose is trust. Whoever was about to buy or hand over their details thinks twice, and many don't come back. The second is forms: asking for a phone number or a card on a page with no padlock is asking someone to trust you at the exact moment the browser is telling them not to. And the third is ranking: Google has treated HTTPS as a signal in your favour for years, and says so in its own material on why HTTPS matters.
Want to know what it would cost you?
We reply the same day. No commitment, no sales pitch.
HTTPS and ranking: what Google looks at
It isn't the heaviest factor in search, but it's one of the cheapest to fix and, unlike others, this one depends only on you. A site served properly over HTTPS takes away Google's excuse to doubt it. And there's a newer layer: the AI assistants that summarise and recommend businesses tend to trust a site with security errors less, so the padlock plays into your GEO positioning too.
How to set up an SSL certificate
Putting it on is quick; leaving it set up properly is what separates a padlock that holds from one that breaks every few days. These four things are the ones that matter.
The free certificate half the internet uses
You don't need to pay for an SSL in most cases. Let's Encrypt, a non-profit, issues free certificates used by hundreds of millions of sites, and almost any decent hosting installs them in a click. A paid certificate only pays off in very specific cases, and it isn't the one a normal business site needs.
Redirect everything to HTTPS
Having the certificate isn't enough. You have to force every old HTTP address to jump to the HTTPS version; otherwise loose pages are left without a padlock and Google ends up seeing two different sites, the secure one and the one that isn't, competing with each other.
The «mixed content» that breaks the padlock
A single image, font or script loaded over HTTP inside a secure page and the padlock disappears. It's fixed by serving absolutely everything on the page over HTTPS; it's the number-one cause of a padlock that comes and goes for no obvious reason.
Make it renew itself
Let's Encrypt certificates expire after ninety days. Set up properly, it renews itself and you never notice. Set up badly, one day you wake up to a site flagged in red with nobody having touched a thing; when a site «goes down» all of a sudden, this is one of the first suspects, as we cover in your website is down.
What an SSL certificate does NOT do
This is where it's worth lowering expectations so you don't get a fright. An SSL certificate encrypts the connection, and that's it. It's not an antivirus and it doesn't protect you from being broken into: that runs on another track, the one we cover in why small business websites get hacked. It doesn't guarantee the company behind the site is trustworthy, because anyone can have a padlock, the bad guys included. And it doesn't make your site faster on its own. It encrypts what travels; no more, no less.
The certificate and your domain go together
The certificate is issued for your domain, so everything runs smoother when the domain is yours and in your name. If the hosting is with one provider and the domain with another, and neither is fully yours, the SSL is one of the first things that tangles the day you want to move something. Why it's worth having the domain in your name is covered in who owns your domain.
We'll tell you in a ten-minute conversation
We reply the same day. No commitment, no sales pitch.
What it costs
Almost always, nothing extra. On any of our plans the SSL certificate is included with the hosting, with no separate line on the invoice: Your Web is 200 € a month and Your Landing 100 €, and the full-presence plans run at 400, 750 and 1,500 € a month, all with hosting, email and maintenance inside. It's published on pricing, plus VAT and with no lock-in, and what the hosting includes is spelled out in what hosting your website needs.
What to check on your site today
You don't need to know any of this to run a quick check. Open your site and confirm there's a padlock next to the address and not a warning. Try going in by typing http:// by hand in front of your address and see whether it jumps to the secure version on its own. Notice if one particular page loses the padlock, which is usually mixed content. And, if you can, check the certificate's expiry date. Any of those that fail can be fixed in a short while.
Where to start
Send us your website address through the form or over WhatsApp and we'll tell you in five minutes whether the SSL certificate is set up properly, whether it's missing the redirect to HTTPS or whether the padlock breaks on a stray image. If it's all fine already, we'll tell you that too and we won't sell you anything you don't need.
Tell us what you need and we'll give you a price
We reply the same day. No commitment, no sales pitch.