What an SSL certificate is and why you need one, even for a small site

What an SSL certificate actually does

When you open a site, your browser and the server exchange data: pages, passwords, card details, form messages. Without SSL, that data travels as plain text, and anyone on the same network (on public Wi-Fi, for example) can read it.

An SSL certificate does two things:

• it encrypts the connection between the visitor and the site, so data cannot be read on the way;
• it proves the site is the real one, not a copy someone put in the middle.

It is easy to spot: the address starts with https:// and the padlock shows in the browser bar.

(Technically, today's connections use TLS, the successor of SSL, but everyone still calls it SSL.)

Why you need it even without an online shop

Browsers warn visitors. Chrome, Firefox and Safari mark sites without SSL as "Not secure". Many people close the page on the spot.

Google prefers HTTPS sites. It counts toward search ranking, and without SSL you start behind.

Forms send personal data. Even a simple contact form sends name, email and phone. Without SSL, that data travels unencrypted.

Some features do not work without HTTPS. Online payments, location, notifications and many plugins require a secure connection.

Free or paid?

For most sites, a free certificate is enough. Let's Encrypt provides free certificates trusted by all browsers, with exactly the same encryption as paid ones.

The difference with paid certificates (OV or EV) is company verification: the issuing authority also checks the company's documents. That mainly matters for banks or large institutions. For a presentation site, a blog or a typical online shop, it adds nothing for visitors.

Does the certificate expire?

Yes. Let's Encrypt certificates are valid for 90 days and must be renewed. On good hosting, renewal is automatic: no worries, no emails, nothing stops.

If your site ever shows "Your connection is not private", the certificate has most likely expired and automatic renewal failed.

What to check once you have SSL

• HTTP to HTTPS redirect. Anyone typing the address without https should be sent to the secure version automatically.
• Mixed content. If the page is on HTTPS but loads images or scripts from http://, the browser may show a broken padlock. In WordPress this is usually fixed by setting the site address to https:// in settings and replacing old links.
• Every version of the domain: both site.com and www.site.com need a certificate.

SSL at Wiptor

On Wiptor web hosting, Let's Encrypt SSL certificates are free and automatic for every domain and subdomain, and they renew by themselves. Add the site in the Wiptor Cloud Panel and the padlock appears without you doing anything else. Hosting starts at €1.99/month, and on Nano and Starter the first month is free with the code WEBHOSTFREE.

See the web hosting plans