SSL & HTTPS, explained
What the padlock in your browser means, why every website needs HTTPS, and how SSL certificates work — in plain English.
If you've ever noticed https:// at the start of a web address, or a padlock icon in your browser's address bar, you've seen SSL in action. It is one of the most fundamental security features on the modern web — and if your website doesn't have it, there are real consequences.
Quick summary
SSL (Secure Sockets Layer) is the technology that makes the connection between your website and its visitors private and encrypted. A site with SSL has an address starting with https:// and a padlock icon in the browser. Every website needs SSL — it protects visitor data, improves search rankings, and stops browsers from showing a "Not Secure" warning to your visitors.
What SSL actually does
When someone visits your website, data travels back and forth between their browser and your web server. Without SSL, this data travels in plain text — meaning anyone who can intercept the connection (on a shared Wi-Fi network, for example) can read it.
SSL encrypts this data. Even if someone intercepts it, they cannot read it.
This matters most when:
- Your visitors fill in a contact form (name, email, message)
- Someone makes a purchase (card details, address)
- A visitor logs into an account on your site
- Any other personal information is entered
Even for sites that don't handle sensitive data, SSL is expected — browsers actively warn users about sites without it.
HTTPS vs HTTP: what's the difference?
| HTTP | HTTPS | |
|---|---|---|
| Stands for | HyperText Transfer Protocol | HyperText Transfer Protocol Secure |
| Encryption | No | Yes (via SSL/TLS) |
| Browser label | "Not Secure" warning shown | Padlock icon |
| Effect on Google rankings | Slight negative signal | Slight positive signal |
| Required for | Effectively nothing anymore | Everything |
What is TLS, and is it different from SSL?
You'll sometimes hear "TLS" (Transport Layer Security) used alongside or instead of "SSL." TLS is the modern, updated version of the older SSL protocol. In everyday conversation, people still say "SSL certificate" even though the actual technology in use is TLS. For your purposes, SSL and TLS mean the same thing.
What browsers show visitors without HTTPS
Modern browsers (Chrome, Firefox, Safari, Edge) actively flag sites without HTTPS. Visitors may see:
- A "Not Secure" label in the address bar
- A warning page before loading your site
- A broken padlock icon
This erodes trust and causes visitors to leave — especially on pages where they might enter any information.
How to get an SSL certificate
Most modern web hosts provide free SSL certificates automatically through Let's Encrypt, a non-profit certificate authority. You don't need to buy one.
Check with your hosting provider:
- Flywheel: SSL is included and managed for you
- WP Engine: SSL is included; you can configure it in the User Portal
- Kinsta: SSL is included and automatic for custom domains
- Most managed WordPress hosts: SSL is included
If your site shows "Not Secure" and your host supports free SSL, contact us or your hosting provider's support to enable it.
How to check if your site has HTTPS
Open your website in a browser.
Look at the address bar. The URL should start with https:// — not http://.
You should see a padlock icon or no security warning. If you see "Not Secure" or a broken padlock, your SSL needs attention.
Mixed content: when HTTPS isn't working properly
Sometimes a site has SSL enabled but still shows security warnings. This is called "mixed content" — the page itself is loading over HTTPS, but some elements (images, scripts, fonts) are loading over HTTP.
Signs of mixed content issues:
- The padlock shows with a warning or an exclamation mark
- Browser developer tools flag HTTP resources
Fixing mixed content usually involves updating internal links and media URLs to use https://. A plugin like Better Search Replace can help with this on WordPress. Ask us if you see this on your site.
Common questions
Related guides
- Securing your WordPress site
- Why security matters for your business
- What is SSL in the hosting context
- Device & Wi-Fi security basics
Need a hand?