HTTPS and SSL Certificates: What Website Owners Need to Know

If your website address begins with https and browsers show a padlock or similar icon, your site is using an encrypted connection. If it begins with http, browsers may label it "Not secure," which is not the first impression any business or ministry wants to make.

Here is what HTTPS does, how certificates work and how to avoid the common problems that trip up site owners.

What HTTPS does

HTTPS is the secure version of the protocol browsers use to load websites. It provides three protections:

• Encryption: information traveling between the visitor and your site, such as form entries, passwords and payment details, cannot be read by others along the way.
• Integrity: the page cannot be secretly altered in transit, for example by a compromised network injecting ads or malicious code.
• Authentication: the visitor's browser can confirm it is talking to the server for your domain, not an impostor.

SSL, TLS and certificates

You will hear "SSL certificate" constantly. SSL is the older name for the technology; the modern protocol is called TLS. People still say SSL out of habit, and both terms usually mean the same thing in practice.

A certificate is a small data file, issued by a trusted organization called a certificate authority, that ties your domain to the encryption keys your server uses. Browsers trust certificates from recognized authorities.

Types of certificates

• Domain validated (DV): confirms control of the domain. This is the most common type and is appropriate for most small business, church and nonprofit websites.
• Organization validated (OV) and extended validation (EV): involve checks on the organization itself. They provide the same encryption but are mainly used by larger organizations with specific requirements.

Free certificates and automatic renewal

Free, trusted certificates are widely available. Let's Encrypt, a nonprofit certificate authority, issues them at no cost, and many hosting companies and website platforms install and renew certificates automatically, from Let's Encrypt or other authorities.

Certificates expire, and the industry has been moving toward shorter certificate lifetimes, which makes automatic renewal more important than ever. If your host handles renewal, confirm it is turned on. If you manage your own server, set up automated renewal and monitoring so you are warned before anything expires.

Common problems and how to fix them

Expired certificates

When a certificate expires, browsers show a full-page warning that frightens visitors away. Automatic renewal prevents this. Add the expiration date to your website maintenance plan as a backup check.

Mixed content

A page loaded over HTTPS that pulls in images, scripts or styles over plain HTTP has mixed content. Browsers may block those items or show a warning. Fix it by updating internal links and embedded resources to use https addresses. Many content management systems have tools or plugins that help find and update old links.

Not redirecting HTTP to HTTPS

Make sure anyone who types or clicks an http address is automatically redirected to the https version. Your host or platform usually offers a setting for this.

Missing coverage for www

If your certificate covers yourdomain.com but not www.yourdomain.com, or the reverse, one version will show errors. Make sure both are covered and that one redirects to the other.

A quick HTTPS checklist

1. Confirm your site loads with https and shows no warnings.
2. Confirm http addresses redirect to https.
3. Check both the www and non-www versions.
4. Confirm automatic renewal is on.
5. Test a few pages for mixed content warnings in your browser.
6. Update links in your email signature, social profiles and printed materials to use https.

What the padlock does not prove

The padlock means the connection is encrypted and the certificate matches the domain. It does not mean the business behind the website is honest. Scam sites use HTTPS too. Our guide to spotting a fake online store explains what else to check.

If you are choosing or reviewing a host, ask about certificates up front; our guide to web hosting types lists other questions worth asking. To learn more about free certificates, visit Let's Encrypt.

Frequently asked questions

Do I need HTTPS if my site does not sell anything?

Yes. Browsers flag non-HTTPS pages as not secure, contact forms collect personal information, and HTTPS protects pages from being altered in transit. Google has also said it uses HTTPS as a ranking signal.

Is a free certificate as secure as a paid one?

The encryption is the same. Paid certificates may add organization validation, warranties or support, which some organizations want, but they do not make the connection more secure.

What happens if my certificate expires?

Visitors see a browser warning saying the connection is not private, and many will leave. Renew it immediately and set up automatic renewal so it does not happen again.