Do I need an SSL certificate for my website?

If you run a small business website in Canada, you have probably seen the term SSL certificate on a hosting invoice, in a quote from a web designer, or in a warning from your browser. You may also have wondered whether it is something you actually need, or just another line item that sounds technical and costs money. The confusion is understandable, because SSL is usually sold with jargon and upsells, and most explanations skip straight to the technical detail without answering the simple question: does my website need one?

For almost every business website, the answer is yes. That includes brochure sites that do not sell anything, one-page sites for a local trades business, and sites that are little more than an online business card. The reasons are practical, not technical: browsers warn visitors away from sites without SSL, search engines give a small advantage to sites that have it, and any form on your site is sending visitor information unprotected without it. The good news is that for most small businesses, a suitable certificate is free, and setting it up takes minutes with a decent host. This guide explains what SSL does in plain language, when it is essential, what it should cost, which type you need, and how to check that yours is set up properly.

The short answer

Yes, your website needs an SSL certificate. An SSL certificate lets your website use HTTPS instead of plain HTTP, which encrypts the connection between your visitor's browser and your website. Without it, browsers mark your site as "Not secure", anything a visitor types into a form travels unprotected, and you give up a small Google ranking advantage. A basic certificate is free through Let's Encrypt, a non-profit certificate authority, and most good hosting plans include one automatically. For the great majority of small business websites, that free certificate is all you need, as long as it is installed correctly, renewed automatically, and paired with a redirect that sends every visitor to the secure version of your site.

The only websites that can reasonably go without SSL are sites nobody visits, such as a private test page on a local network. If your site is public and represents your business, go without it only if you are comfortable with browsers warning visitors that the connection is not secure. That is not a trade-off most businesses want to make for something that costs nothing.

What an SSL certificate actually does

An SSL certificate does three things, and all three matter to a business owner even if the technology behind them does not.

First, it encrypts the connection. When a visitor loads your site over HTTPS, the data travelling between their browser and your server is scrambled so that anyone intercepting it, for example on public Wi-Fi in a coffee shop or an airport, cannot read it. That matters most for anything a visitor types in: a name and phone number in a contact form, an email address in a newsletter sign-up, a password on a login page, or card details at checkout. Without encryption, that information travels as plain text.

Second, it proves the site is really yours. A certificate is issued for your specific domain name, and the browser checks it before loading the page. If someone set up a copy of your site on a lookalike domain to trick your customers, that copy could not present a valid certificate for your domain. The padlock in the address bar is the visible result of that check. It tells visitors the page they are looking at really came from your domain, not from an impostor.

Third, it changes how browsers treat your site. Modern browsers actively warn visitors about sites served over plain HTTP. In Chrome, Firefox, Safari, and Edge, a site without SSL shows a "Not secure" label in the address bar, and a visitor who tries to submit a form on that site gets a clearer warning still. If the certificate is expired or misconfigured, the warning is stronger: a full-page security screen that most visitors will not click past. A certificate is what keeps those warnings away.

One point worth making clearly: the letters SSL are historical. The technology in use today is actually called TLS, and certificates are technically TLS certificates. Everyone in the industry still calls them SSL certificates, including hosts, registrars, and Google, so this guide does the same. You do not need to know the difference to buy or use one.

The padlock and the "Not secure" warning

The most visible effect of SSL is in the browser address bar, and it is the effect your customers notice first. Since Chrome 68, released in July 2018, Chrome has marked every page served over plain HTTP as "Not secure". Other browsers followed the same approach. The label sits right next to your web address, visible before a visitor reads a single word of your site.

That label is a trust problem before it is a technical one. A visitor comparing two local businesses will not consciously think about encryption. They will notice that one site shows a padlock and the other shows a warning, and they will feel more comfortable contacting the first one. For a business that depends on enquiries from its website, that first impression is worth more than the certificate itself costs, which is usually nothing.

The warning also gets in the way of the things your website is supposed to do. If a visitor starts filling in your contact form and the browser warns them the connection is not secure, some will stop. If a visitor clicks through from Google and sees a full-page security warning because your certificate expired, most will go back to the search results and choose a competitor. SSL is, in that sense, part of your website's first impression, in the same way as a tidy design and a working phone number.

Do I need an SSL certificate if I do not sell anything online?

Yes, and this is where many small businesses get caught out. A lot of owners assume SSL only matters for online shops, because that is where card payments happen. If you take card payments, then yes, it is essential. But even a brochure website usually collects some kind of data. A contact form, an enquiry form, a newsletter sign-up, a booking request, or a login area all involve visitor information, and that information deserves to travel encrypted.

Even if your site has nothing more than a simple contact page, SSL still matters. The browser warning appears whether or not you collect data, because browsers cannot tell from the outside whether a page will ask for information later. A visitor who sees "Not secure" does not think "this site does not collect data, so the warning is harmless". They think the site is not safe. And if your site has no forms at all, you still benefit from the ranking advantage and the trust signal, and you lose nothing, because the certificate is free.

Think of it this way: SSL is no longer a security feature for online shops. It is a basic part of running a professional website, in the same category as having your own domain name rather than a free subdomain, and a business email address rather than a personal one. Visitors expect it, browsers enforce it, and search engines reward it.

When SSL is absolutely non-negotiable

For most sites, SSL is strongly recommended. For some, it is not optional at all, and going without it will break things outright.

• You take payments online. Payment providers such as Stripe, PayPal, and Square require HTTPS for checkout to work. Without a certificate, you simply cannot take card payments through your website.
• Visitors log in to your site. A customer portal, a membership area, a booking system with accounts, or a WordPress admin login all send passwords over the connection. Without SSL, those passwords travel unprotected.
• You collect personal information. Names, email addresses, phone numbers, addresses, and booking details are personal information. Under Canada's federal privacy law, PIPEDA, businesses must protect personal information with security safeguards appropriate to its sensitivity. An unencrypted form is a hard position to defend if that information is intercepted or if a customer complains. Some provinces have their own privacy laws with similar expectations.
• Your site handles bookings or quotes. A booking request usually includes a name, a phone number, a date, and sometimes an address or health detail, depending on the business. That is personal information, and it deserves an encrypted connection.
• You run ads or track visitors. Some advertising and analytics features, and some browser features such as location prompts, only work on secure pages. An HTTP site can quietly lose functionality you assumed was working.

If any of these apply to your site, treat SSL as a requirement, not a nice-to-have, and check today that it is actually working. The quickest check is to open your site in a browser and look for the padlock. If you see "Not secure" instead, the rest of this guide explains how to fix it.

Does SSL help with Google rankings?

Yes, a little. Google has used HTTPS as a ranking signal since 2014, and has said publicly that it is a lightweight signal, meaning it will not rescue a weak site or outrank a strong competitor on its own. Think of it as a small tiebreaker: between two similar pages, the secure one has a slight edge. That edge is real, but it is not the main reason to get a certificate. The main reasons are the browser warnings and visitor trust described above.

SSL also matters for how Google indexes your site. Google treats the HTTP and HTTPS versions of a page as different addresses. If your site is available on both, Google can split ranking signals between the two versions, or index the wrong one. That is why installing the certificate is only half the job. The other half is redirecting every HTTP address to its HTTPS equivalent, so there is only one version of each page for Google to index. That step is covered below.

There is also a practical search benefit that has nothing to do with rankings. Google Search Console, the free tool that tells you how Google sees your site, flags security issues and reports on HTTPS coverage. A site without SSL will show up there with warnings you would rather not have. Our guide to setting up Google Search Console walks through the setup, and it is worth doing once your certificate is in place so you can confirm Google sees the secure version of your pages.

How much does an SSL certificate cost?

For most small business websites, nothing. Let's Encrypt, a non-profit certificate authority, issues free certificates that browsers trust exactly the same way they trust paid ones. A free Let's Encrypt certificate encrypts the connection just as well as a certificate that costs hundreds of dollars a year. Most good hosting providers issue and renew these automatically as part of the hosting plan, so you never see an invoice for one and never have to think about renewal dates.

Paid certificates still exist, and some businesses do need them, but for a typical local business site they rarely add anything. Paid certificates can cost anywhere from about $10 to a few hundred dollars a year, depending on the type and the seller. If someone is charging you $50 to $100 a year for a basic certificate on a simple business site, ask what you are getting that a free one does not give you. For most local business sites, the answer is nothing, and the charge is a markup on something your host would provide for free.

There are a few situations where paying makes sense. If your business needs a warranty attached to the certificate, which some paid certificates include, or if you need a certificate that covers many subdomains under one purchase, or if your organisation requires a certificate that verifies your legal business identity, then a paid option may be justified. Those are specific needs, though, not the default. Start from the free certificate, and only pay if you can name the specific benefit you are buying.

Watch out for one common trap: some hosts and designers charge a yearly "SSL fee" while quietly using a free Let's Encrypt certificate behind the scenes. That is not necessarily dishonest if they are charging for the setup and management, but it should be labelled as a service fee, not as the cost of the certificate itself. Ask your host whether SSL is included in your plan, and whether renewals are automatic. If the answer to either question is no, that is a reason to question the plan, not a reason to pay extra for a certificate. Our guide to web hosting costs in Canada covers what a good hosting plan should include, including SSL, and the intro-price trap to watch for when comparing plans.

Which type of SSL certificate do you need?

Certificates come in three validation levels, and the difference is how much checking the certificate authority does before issuing one. For most small businesses, the simplest level is the right one.

Domain Validated (DV) certificates only confirm that the person requesting the certificate controls the domain name. That check is automated and takes minutes. A DV certificate is the most common type in the world, it is the type Let's Encrypt issues for free, and it is the right choice for the vast majority of small business websites, whether you sell online or not. The padlock and the encryption are identical to the more expensive types.

Organization Validated (OV) certificates also verify that the business is legally registered, which involves checking business documents and takes days rather than minutes. An OV certificate can make sense for a larger business that wants its verified legal name attached to the certificate, but it changes nothing about what visitors see in the browser. There is no visual difference between a site secured by a DV certificate and one secured by an OV certificate.

Extended Validation (EV) certificates involve the most thorough checks of the business, and they used to show the company name in the browser address bar. Browsers no longer display that name prominently, so the main visible benefit of EV has effectively disappeared, while the cost and the paperwork remain. EV certificates are now mostly relevant to large enterprises and financial institutions with specific compliance requirements. A small business does not need one.

There is one more distinction worth knowing: a standard certificate covers one domain, such as yoursite.ca, and usually the www version of it as well. If you run several subdomains, such as shop.yoursite.ca and bookings.yoursite.ca, you may need a wildcard certificate, which covers all subdomains under one domain. Most hosts handle this automatically, but if you add a subdomain and it shows a security warning, a missing wildcard certificate is the first thing to check.

How to get an SSL certificate for your website

Getting a certificate is usually a short job, and for many sites it is already done. Work through these steps in order.

Step 1: Check whether you already have one. Open your website in a browser and look at the address bar. If you see a padlock and the address starts with https, you already have a certificate. If you see "Not secure" or the address starts with http, you do not, or it is not working. You can also check with a free SSL checker tool, which will tell you whether the certificate is valid, which domains it covers, and when it expires.

Step 2: Ask your host. Log in to your hosting account and look for an SSL or security section. Most reputable hosts, including Canadian hosts and the major international ones, offer free certificates and will install one in a few clicks. If your host charges extra for a basic certificate, or if there is no obvious way to enable one, ask their support team directly, and consider whether the plan is giving you fair value.

Step 3: Redirect all traffic to HTTPS. Installing the certificate does not automatically send visitors to the secure version. Your host or developer needs to set up a redirect so that anyone who types or clicks the old http address lands on the https version instead. Check this yourself: type the http address into a browser and confirm it ends up on the https version. Every page should redirect, not just the homepage.

Step 4: Fix mixed content. After the redirect, some pages may still load individual pieces, such as an image, a script, or a font, over plain HTTP. The browser will flag this as mixed content, and the padlock may disappear or show a warning on those pages. The fix is to update those links to https, or to relative links that follow the page. Your developer or a mixed-content checking tool can find the offending items. This is the most common reason a site has a certificate but still does not show a clean padlock.

Step 5: Update your links and listings. Once the site is fully on HTTPS, update the address in Google Search Console, Google Business Profile, your social media profiles, your email signature, and any directories or listings that link to the old address. Old HTTP links will still work if the redirect is in place, but updating them avoids relying on the redirect forever and keeps your listings tidy.

Step 6: Confirm Google sees the secure version. In Google Search Console, add the HTTPS version of your site as a property if it is not already there, and check that Google is indexing the HTTPS pages. If you are moving an existing site from HTTP to HTTPS, expect a short period while Google re-crawls and updates its index. The redirect keeps visitors and rankings moving to the right place in the meantime. If you are changing hosts or rebuilding at the same time, our guide to migrating a website without losing SEO covers the redirect and testing steps that protect your rankings through the change.

Certificates expire, and they are expiring faster

Every SSL certificate has an expiry date, and when it passes, visitors get a full-page security warning instead of your website. Let's Encrypt certificates last 90 days, which sounds short, but they are designed to renew automatically, so the short lifetime never becomes a problem as long as automatic renewal is working.

Paid certificates used to last a year or more, but that is changing. The CA/Browser Forum, the industry group that sets the rules certificate authorities must follow, voted in April 2025 to shorten the maximum certificate lifetime in stages: 200 days for certificates issued from March 15, 2026, then 100 days from March 15, 2027, and 47 days from March 15, 2029. The direction is clear: certificates will need renewing far more often, and renewing by hand will stop being practical.

That change matters for small businesses in one specific way: automatic renewal is no longer a convenience, it is the only reliable approach. If your certificate renews automatically through your host, nothing changes for you. If someone renews yours manually once a year, that routine will break as lifetimes shorten, and an expired certificate will take your site offline for visitors. Ask your host or developer to confirm that renewal is automatic, and set a calendar reminder to check the padlock once a quarter, so an expiry is caught before your customers see it.

Common SSL problems and how to fix them

Most SSL problems are easy to recognise and quick to fix once you know what to look for.

The padlock is missing on some pages. This is usually mixed content: one image, script, or stylesheet still loading over HTTP. Find the item and change its link to HTTPS. If your site runs on WordPress, a plugin can search for and replace old HTTP links in your content, but check the results afterwards, because a blanket search and replace can break links that should stay as they are.

The site works with www but not without it, or the other way round. Your certificate may only cover one version of the domain. Most hosts issue certificates that cover both, but if yours does not, ask the host to reissue it covering both versions, and set a redirect so there is only one canonical version of the site.

Visitors see a warning that the certificate has expired. Automatic renewal has failed, or renewal was never set up. Contact your host first, because they can usually reissue the certificate quickly. Then find out why renewal failed, whether a domain validation record was changed, a firewall blocked the renewal check, or the host simply does not automate it, and fix the cause rather than just the symptom.

The site loads over HTTPS but the redirect is missing. Visitors who type the old address, or follow an old link, land on the insecure version and see the warning. Add the redirect from HTTP to HTTPS, and test it by typing the HTTP address yourself. Our guide to protecting your website from hackers covers HTTPS as part of a wider security routine, including updates, passwords, two-factor authentication, and backups, which are the steps that matter once SSL is in place.

A subdomain shows a warning. The certificate does not cover that subdomain. Ask your host for a wildcard certificate, or issue a separate certificate for the subdomain. This is common when a business adds a shop or booking system on a subdomain after the main site was set up.

What SSL does not do

It is important to be clear about the limits, because SSL is sometimes sold as if it were complete website security. It is not. SSL secures data in transit between the browser and the server. It does not protect your website from every threat, and a padlock does not mean a site is safe in every sense.

SSL will not stop an attacker who logs in with a stolen password, exploit an outdated plugin, abuse an unprotected contact form, or trick you into handing over your hosting login through a phishing email. It will not clean up malware already on the site, and it will not back up your content if the site is deleted. It also does not verify that a business is legitimate in any deep sense. A scam site can have a perfectly valid DV certificate, because that certificate only confirms control of the domain, not the honesty of the owner.

Think of SSL as one layer of a short list: HTTPS everywhere, software kept updated, long unique passwords in a password manager, two-factor authentication on every account that touches the site, automatic backups stored away from the server, and a routine check that everything is still working. SSL is the cheapest and easiest layer on that list, which is why it comes first, but it is still only one layer.

How Webloped fits in

We are a web design and AI automation company based in Cambridge, Ontario. Every site we build starts with the security foundation in this guide: HTTPS throughout, with the certificate installed, automatic renewal confirmed, and every page redirecting to the secure version, so the basics are not left for later. If your current site shows a "Not secure" warning, or you are not sure whether your certificate renews automatically, we can check it and fix it, usually in a single short visit. Our services page outlines what we do, and our pricing page explains how projects are structured in CAD. If you would like a straight read on where your current site stands, send us a message or email contact@webloped.ca. We will tell you plainly what to fix first, whether or not you hire us to do it.

Frequently asked questions

Do I need an SSL certificate for a simple brochure website?

Yes. Browsers mark every site without SSL as "Not secure", whether or not the site collects information, and most brochure sites have at least a contact form. A basic certificate is free through Let's Encrypt and most hosts install it automatically, so there is no cost reason to go without one.

How much does an SSL certificate cost in Canada?

For most small business websites, nothing. Let's Encrypt issues free certificates that browsers trust the same as paid ones, and most Canadian and international hosting plans include one. Paid certificates range from about $10 to a few hundred dollars a year, and are only worth paying for if you need a specific benefit, such as a warranty or verification of your registered business name.

What happens if my SSL certificate expires?

Visitors see a full-page security warning instead of your website, and most will leave rather than click through. That is why automatic renewal matters. Let's Encrypt certificates last 90 days and renew automatically when set up properly, and paid certificates are moving to shorter maximum lifetimes as well, with a 200-day limit from March 15, 2026. Ask your host to confirm renewal is automatic, and check the padlock yourself once a quarter.

Is a free SSL certificate as good as a paid one?

For encryption and browser trust, yes. A free Let's Encrypt certificate encrypts the connection exactly as well as a paid certificate, and browsers show the same padlock. Paid certificates add extras, such as a warranty or verification of the business behind the site, which matter to some larger businesses but make no visible difference to visitors on a typical small business site.