The little padlock in your browser
Next time you visit a website, look at the address bar at the top of the screen. On most sites you will see a small padlock icon, or a similar symbol, next to the web address. You will also see that the address starts with https rather than http.
That padlock and that extra letter tell you the site has an SSL certificate. It is one of those things most people never think about until it is missing.
What SSL actually does
SSL stands for Secure Sockets Layer. These days the technology has a newer name, TLS, but almost everyone still says SSL, so we will too.
In plain terms, an SSL certificate does two jobs.
- It scrambles the information travelling between your visitor's phone or computer and your website, so nobody in between can read it.
- It confirms that the website really is the one at that address, and not an impostor.
Without it, anything typed into your site travels in plain text. On public wifi in a café or a train station, that information could in theory be read by someone else on the same network.
What the s in https means
The http at the start of a web address is simply the method browsers use to fetch web pages. The s stands for secure. When a site has a working SSL certificate, the address switches to https and the browser shows the padlock.
You do not need to type https yourself. A properly set up site sends visitors to the secure version automatically, even if they type the address without it.
The "Not secure" warning
If a website does not have SSL, or the certificate has expired, browsers such as Chrome, Safari and Edge show a warning. Often it is the words "Not secure" next to the address. Sometimes, if a certificate has expired or is set up wrongly, the browser shows a full page warning before the visitor can even reach your site, telling them the connection is not private.
Picture a potential customer looking for a local electrician. They find your site, and the first thing they see is a warning from their browser. Many people will simply press back and try the next business in the list.
Why it matters for trust
For owner-run businesses, trust is everything. People are inviting you into their homes, letting you near their hair, or handing you the keys while they are at work. Your website is often their first impression.
A missing padlock does not mean your business is untrustworthy, of course. But it plants a small doubt at exactly the moment you want someone to feel confident. A working certificate removes that doubt quietly, without anyone noticing.
Search engines also take security into account. Google has said that https is one of the signals it uses. It is not a magic switch for ranking, but there is no good reason to be without it.
Why it matters for forms
If your website has a contact form, a quote request or a booking form, SSL matters even more. Those forms collect names, phone numbers, addresses and sometimes details about someone's home or situation.
That is personal information. Your customers expect it to be handled with care, and you have a responsibility to protect it under UK data protection rules. Sending it over an unsecured connection is not a good look, and some browsers will warn people when they start typing into a form on a site without SSL.
How SSL is usually provided
The good news is that SSL is now very common and usually straightforward. There are a few typical ways it is set up.
- Many hosting companies include a free certificate as standard, often from a non-profit provider called Let's Encrypt.
- Some hosts and website builders switch it on automatically when your site goes live.
- Paid certificates exist too, mostly used by larger organisations that want extra checks on their company identity.
For a typical local business website, a standard certificate does the job perfectly well. What matters most is that it is installed properly and covers both versions of your address, with and without the www at the start.
Renewal, the bit that catches people out
SSL certificates do not last forever. They expire and must be renewed. Free certificates in particular are often short-lived, lasting a few months at a time, so they are designed to renew automatically.
Usually this just works. Problems tend to happen when:
- Automatic renewal has been switched off or has failed quietly
- The site has been moved and the certificate was not set up again
- The domain settings have changed and the renewal can no longer complete
- Nobody is checking, so the first anyone hears of it is a customer mentioning the warning
If you manage your own site, set a reminder every couple of months to visit it on your phone and check the padlock is still there.
Leaving it to someone else
If you would rather not think about any of this, that is completely fair. Every We are Graft plan includes hosting and an SSL certificate, kept renewed for you as part of the monthly fee, so there is no separate renewal to remember. You can see the full list of what is included on our pricing page.
Not sure about your own site
If your site is showing a "Not secure" warning, or you just want a second opinion, drop us a message through our contact page. If you are thinking about a new site anyway, you can ask for a free design and see it before you pay anything. Read more about how that works.