Chykalophia Docs

What the security icon in your browser means, why every website needs HTTPS, and how SSL certificates work — in plain English.

If you've ever noticed https:// at the start of a web address, or a security icon next to it in your browser's address bar, you've seen SSL in action. It is one of the most fundamental security features on the modern web — and if your website doesn't have it, there are real consequences.

Quick summary

SSL (Secure Sockets Layer) is the technology that makes the connection between your website and its visitors private and encrypted. A site with SSL has an address starting with https:// and no security warning in the browser. Every website needs SSL — it protects visitor data, being served securely is one of the questions Google asks about page experience, and it stops browsers from showing a "Not Secure" warning to your visitors.

What SSL actually does

When someone visits your website, data travels back and forth between their browser and your web server. Without SSL, this data travels in plain text — meaning anyone who can intercept the connection (on a shared Wi-Fi network, for example) can read it.

SSL encrypts this data. Even if someone intercepts it, they cannot read it.

This matters most when:

Your visitors fill in a contact form (name, email, message)
Someone makes a purchase (card details, address)
A visitor logs into an account on your site
Any other personal information is entered

Even for sites that don't handle sensitive data, SSL is expected — browsers actively warn users about sites without it.

HTTPS vs HTTP: what's the difference?

	HTTP	HTTPS
Stands for	HyperText Transfer Protocol	HyperText Transfer Protocol Secure
Encryption	No	Yes (via SSL/TLS)
Browser label	"Not Secure" next to the address	No warning — a neutral site-information icon
Effect on Google rankings	Misses it	Google called HTTPS "a very lightweight signal" in 2014; its current guidance says page experience aspects beyond Core Web Vitals don't directly lift rankings — see below
Required for	Effectively nothing anymore	Everything

What is TLS, and is it different from SSL?

You'll sometimes hear "TLS" (Transport Layer Security) used alongside or instead of "SSL." TLS is the modern, updated version of the older SSL protocol. In everyday conversation, people still say "SSL certificate" even though the actual technology in use is TLS. For your purposes, SSL and TLS mean the same thing.

What browsers show visitors without HTTPS

Modern browsers (Chrome, Firefox, Safari, Edge) actively flag sites without HTTPS. Visitors may see:

A "Not Secure" label in the address bar
A warning icon where a secure site shows nothing unusual
A warning instead of your page, if the visitor has turned on their browser's "always use secure connections" setting

Chrome's own guidance for a site without a private connection is blunt: "the site owner must secure the site and your data with HTTPS." This erodes trust and causes visitors to leave — especially on pages where they might enter any information.

How to get an SSL certificate

Most modern web hosts include a free SSL certificate and renew it for you. Usually it comes from Let's Encrypt — a nonprofit certificate authority — or through Cloudflare. You don't need to buy one.

Check with your hosting provider:

Flywheel: "Simple SSL" is free and automatic once you turn it on for the site, using a Let's Encrypt certificate. It can't issue a wildcard, OV or EV certificate — for those you bring your own.
WP Engine: free single-domain certificates are included and managed in the User Portal (Sites → your environment → SSL). Certificates default to auto-renew.
Kinsta: every verified domain is covered automatically by Kinsta's Cloudflare integration, including wildcard support on Managed WordPress plans. Renewal is automatic as long as the _acme-challenge CNAME record stays in your DNS.
Most managed WordPress hosts: SSL is included

If your site shows "Not Secure" and your host supports free SSL, contact us or your hosting provider's support to enable it.

How to check if your site has HTTPS

Open your website in a browser.

Look at the address bar. The URL should start with https:// — not http://.

You should see no security warning — a neutral site-information icon, or in some browsers a padlock. If you see "Not Secure," your SSL needs attention.

Mixed content: when HTTPS isn't working properly

Sometimes a site has SSL enabled but still shows security warnings. This is called "mixed content" — the page itself is loading over HTTPS, but some elements (images, scripts, fonts) are loading over HTTP.

Signs of mixed content issues:

The security icon changes to a warning or an exclamation mark
Browser developer tools flag HTTP resources

Fixing mixed content usually involves updating internal links and media URLs to use https://. A plugin like Better Search Replace can help with this on WordPress. Ask us if you see this on your site.

Common questions

Does SSL mean my site is safe?

SSL means the connection between your site and your visitors is encrypted. It doesn't mean your site can't be hacked, doesn't contain malware, or is run by a legitimate business. It is one security layer — not a complete guarantee. See Securing your WordPress site.

Will SSL affect my website's performance?

Modern SSL adds negligible overhead. The newer versions of the web protocol — HTTP/2 and HTTP/3 — are both designed for better performance than the older HTTP/1.1, and they are normally used over HTTPS.

Does Google require HTTPS?

No. Google's own pages point two ways on how much it helps your ranking. In 2014 Google announced HTTPS as a ranking signal and called it "a very lightweight signal," carrying less weight than things like high-quality content. Its current page experience guidance asks "are your pages served in a secure fashion?" as one aspect to get right, but adds that beyond Core Web Vitals, other page experience aspects "don't directly help your website rank higher in search results."

Either way, do it for your visitors rather than for the rankings. Chrome shows a "Not Secure" label on sites without HTTPS, and that costs you trust on every page where someone might type something in.

My SSL certificate expired — what happens?

Browsers will show a prominent warning page to everyone who visits your site, and most people will leave immediately. Renewing it takes priority. Let's Encrypt certificates — the most common free kind — are valid for 90 days by default, which is why automatic renewal matters; most managed hosts handle it, but check yours. If it has expired, contact us or your host's support immediately.

What is an EV certificate (the green address bar)?

Extended Validation (EV) certificates require companies to go through more thorough identity verification, and used to show the company name in green in the browser. Browsers have since dropped that treatment — Chrome, for example, now documents one "secure" state for every HTTPS site, with no company name in the address bar. So an EV certificate buys you nothing a visitor can see. For most business websites, a standard SSL certificate (Domain Validation or Organization Validation) is perfectly appropriate. Note that some managed hosts only issue Domain Validation certificates, so an EV or wildcard certificate means buying one and installing it yourself.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

SSL & HTTPS, explained