Chykalophia Docs

Learn what SSL certificates and HTTPS are, why they matter for your website, and how they're managed on your hosting platform.

If you look at the address bar in your browser, you'll see either http:// or https:// before a website address. That "S" stands for secure — and it's made possible by something called an SSL certificate. It's one of the most important things your website needs.

Quick summary

SSL (Secure Sockets Layer) is the everyday name for the technology that encrypts the connection between your visitor's browser and your website. (Today that technology is actually TLS, SSL's successor.) It's what changes http to https and stops the browser flagging your site as "Not secure". On Flywheel, WP Engine, and Kinsta, SSL certificates are included free, and once they're set up they renew automatically.

What SSL actually does

When a visitor connects to your website, information travels back and forth between their browser and your server. Without SSL, that information is transmitted in plain text — anyone in between (a hacker on a shared Wi-Fi network, for example) could read it.

With SSL, the data is encrypted. Even if someone intercepts it, they see scrambled nonsense they can't decode.

This matters especially when:

Visitors fill in a contact form (their name and email are protected).
Customers enter payment details or personal information.
Anyone logs in to your site.

SSL vs TLS: what's the difference?

You'll sometimes see TLS (Transport Layer Security) mentioned. TLS is the modern, more secure version of SSL. The two terms are often used interchangeably in everyday conversation, but if you want to be precise, today's websites use TLS. Either way, the result is the same: an encrypted https:// connection.

Why HTTPS matters for your business

Trust

Visitors expect a secure connection. Without one, browsers warn them: Chrome, for example, labels pages loaded over plain HTTP "Not secure" in the address bar, which can scare visitors away from your site.

Search rankings

Google uses HTTPS as a ranking signal, and serving pages securely is one of the things it lists under a good page experience. When Google announced the signal in 2014 it called it "a very lightweight signal" that carried less weight than high-quality content, and said it might strengthen it over time. Either way, there's no reason to give it up.

Legal and compliance

If your site collects any personal data, even just an email address from a contact form, privacy laws such as the EU's GDPR expect you to keep it secure, and GDPR names encryption as one appropriate measure. HTTPS helps you meet that expectation.

How SSL is managed on our platforms

Flywheel provides a free SSL certificate for each site through its Simple SSL feature, with certificates issued by Let's Encrypt. You switch it on from the site's Flywheel dashboard once your domain points to Flywheel. After that, Flywheel renews it automatically and you don't need to do anything. See SSL on Flywheel for details.

What you might notice

When SSL is working correctly:

Your site address starts with https://
Many browsers show a padlock icon in the address bar. (Google announced in 2023 that Chrome would replace its padlock with a neutral "tune" icon, so you may not see one there.)
There's no "Not secure" warning

If you ever see a security warning, or images and styles go missing on an https:// page, let us know right away. This usually means a certificate has expired or there's a mixed-content issue (some elements requested over HTTP instead of HTTPS).

Common questions

Does SSL cost extra?

Not on our recommended platforms. Flywheel, WP Engine, and Kinsta all include free SSL certificates. They come from certificate authorities such as Let's Encrypt (Flywheel, and WP Engine's Legacy Network) or through Cloudflare (Kinsta, and WP Engine's Advanced Network).

Do I need to renew my SSL certificate?

Not the free certificates on our recommended hosts: they renew automatically (on Kinsta, as long as the required DNS record stays in place). Certificates you buy from a third party are different: WP Engine and Kinsta both say you have to renew those yourself and upload the new one. Certificate lifetimes are also getting shorter across the industry. Since March 15, 2026, a publicly trusted certificate can be valid for at most 200 days, dropping to 100 days in March 2027 and 47 days in March 2029. Let's Encrypt's free certificates last 90 days by default. Automatic renewal matters more every year.

What's the 'Not secure' warning in my browser?

It usually means the page isn't being served over a working HTTPS connection: the site has no valid SSL certificate, or the page loaded over plain http://. If the address does start with https:// and something still looks wrong, a mixed-content problem (some images or scripts requested over HTTP) is a common cause. See troubleshooting hosting problems for help.

Does SSL affect my site's speed?

Not in a way visitors will notice on a modern host. Encryption adds a little work, but HTTPS also unlocks performance features that browsers don't offer over plain HTTP, such as HTTP/3, which Kinsta's CDN and WP Engine's Advanced Network both support.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

What is SSL & HTTPS?