An SSL certificate is a small data file that encrypts the connection between your website and the people visiting it. When you install one, your site loads over HTTPS instead of HTTP, and browsers show a padlock next to your address. That padlock tells visitors the data they send, contact form entries, passwords, and card details, cannot be read in transit.
What an SSL certificate actually does #
The certificate handles two jobs. It encrypts traffic so no one between your visitor and your server can read it, and it verifies that your site is the one it claims to be. Without it, data travels as plain text that anyone on the same network can capture. On public wifi that risk is real, and it applies to any form on your site, not only checkout pages.
When the certificate is valid and installed correctly, the browser shows HTTPS and the padlock. When it is missing or expired, Chrome and Firefox display a “Not Secure” warning in the address bar. That warning scares off visitors before they read a word.
Why every small business site needs one #
Three reasons make SSL non-negotiable in 2026.
- Browsers flag sites without it. Chrome marks any HTTP page as “Not Secure,” and most people leave rather than risk it.
- Google treats HTTPS as a ranking signal. Secure sites get a small edge in search, and insecure ones lose visitor trust fast.
- Trust and conversions. A visitor who sees a warning will not enter an email or a card number. The padlock is the baseline people expect.
If you take payments, collect emails, or run a login, SSL is required by payment processors and privacy rules. Even a plain brochure site needs it now, because the “Not Secure” label applies to every page served over HTTP.
Free vs paid certificates #
Both free and paid certificates use the same encryption strength. The difference is validation level, support, and warranty, not how well they protect data.
Free certificates #
Let’s Encrypt issues free certificates that most hosts install automatically. They are Domain Validated, which means they confirm you control the domain and nothing more. They renew every 90 days, and good hosting renews them for you without any action on your part. For the large majority of small business sites, a free certificate is enough.
Paid certificates #
Paid certificates come from vendors like DigiCert or Sectigo and add higher validation tiers:
- Organization Validated (OV) confirms your business is registered and real.
- Extended Validation (EV) runs a deeper legal check before issuing.
- Wildcard and multi-domain certificates cover many subdomains under one file.
Paid options also include a warranty and human support, which some larger companies want. For a typical local business, none of that changes what visitors see. The padlock looks the same whether the certificate cost nothing or several hundred dollars.
What SSL costs in 2026 #
Here is the honest range this year:
- Free. Let’s Encrypt and host-bundled certificates cost nothing and cover DV needs.
- Basic paid DV. Roughly 10 to 60 dollars per year for a vendor certificate with support.
- OV certificates. Around 50 to 200 dollars per year.
- EV certificates. Roughly 100 to 400 dollars per year, aimed at firms that want the deepest identity check.
- Wildcard. Often 100 to 300 dollars per year for broad subdomain coverage.
Prices vary by vendor and term length, and multi-year deals lower the yearly rate. For most owners reading this, the right number is zero.
How to get set up #
The path is short:
- Confirm your host offers free SSL, which nearly all do in 2026.
- Enable it in your hosting panel, or install a Let’s Encrypt certificate through the provided tool.
- Force HTTPS so every visitor lands on the secure version. On WordPress, a plugin or a single setting handles the redirect.
- Update internal links and any hard-coded HTTP references so you avoid mixed-content warnings.
Once HTTPS is live, test a few pages and check that the padlock shows with no warnings. If you are still choosing a provider, our small business hosting checklist covers which hosts bundle SSL from the start.
What to remember #
SSL is required, cheap, and usually free. Turn on the certificate your host provides, force HTTPS, and confirm the padlock. Spend on a paid certificate only when your business genuinely needs OV or EV validation, which most small sites never do. Get the free one working first, then move on to the parts of your site that win customers.
