Do you really need an SSL certificate?
An SSL certificate (technically TLS today) encrypts the connection between the visitor and your site and shows the padlock in the browser. The address changes from http to https.
Do you always need one?
In practice, yes. Browsers warn visitors who open a site without https, and many leave. It becomes essential if your site has a contact form, a login, a customer area or a shop, because the data would travel unencrypted. For Google it is also a small but known signal.
Free or paid?
- Free. Many hosting plans include a free certificate and renew it automatically. For a brochure site or a blog it is usually enough.
- Paid. Worth it when you want the organization's identity verified, a warranty in case of problems, coverage for many subdomains, or someone else to manage it. See SSL certificates.
The most common mistakes
- Expired certificate. The browser shows a full-screen red warning. Make sure renewal is automatic.
- Mixed content. https pages loading images or scripts over http: the padlock disappears.
- Only the home page on https. The certificate must cover the whole site and the redirect from http must be active.
In short
Always enable it. If your hosting includes one, use it. If you need a warranty, organization validation or a turnkey service, consider a paid certificate or the managed SSL service.