Security
What an SSL certificate is and why your site needs one
An SSL certificate encrypts the connection between your site and its visitors and makes the padlock appear. We explain what it is, why it is required today, which types exist, how renewal works and how to fix mixed content.
HostSpace team
5 min read
Key takeaways
- SSL (now TLS) encrypts data between the browser and your site.
- Without a certificate, browsers flag your site as “Not secure”.
- A DV certificate is enough for most small businesses.
- Turn on automatic renewal and fix any mixed content.
Article contents
What an SSL certificate is
Every time someone visits your site, their browser and your server exchange information: the pages being displayed, the details typed into a contact form or the data of an order. An SSL certificate makes that exchange travel encrypted, turned into a code that nobody else can read along the way.
The technology actually in use today is called TLS, the modern successor of SSL. The name “SSL” stuck in everyday language, though, so you will see both terms used for the same thing: the certificate that protects the connection to your site.
Besides encrypting, the certificate works as a kind of ID card: it tells the browser that it is talking to the real server for your domain and not to an impostor.
Certificates are issued by certificate authorities, organizations that browsers already trust. Before issuing one, the authority checks that whoever requests it controls the domain. That is why a certificate is only valid for the names listed in it: if it covers yourbusiness.com but not www.yourbusiness.com, anyone visiting the www version will see a warning.
HTTPS and the browser padlock
When your site has a properly installed certificate, its address starts with https:// instead of http://. The “s” stands for “secure”. Browsers show it with a padlock or settings icon next to the address, and clicking it reveals the certificate details.
If your site has no certificate, the browser shows a Not secure warning. For a visitor who isn't technical, that message is enough to close the tab, especially when they are about to share their details or place an order.
Why it is required today
Years ago SSL was something for banks and online stores. Now every site needs it:
- Browsers demand it. Chrome, Safari, Firefox and Edge flag sites without HTTPS as not secure, and some modern browser features only work on secure pages.
- Search engines take it into account. Google has confirmed that HTTPS is one of the signals it uses to rank pages. It isn't the only thing that matters, but a site without a certificate starts at a disadvantage.
- Your customers expect it. Contact forms, logins and payments handle personal data. Protecting it is part of running a trustworthy business.
It is worth being clear about what SSL does not do, though. It encrypts the connection, but it won't stop someone from guessing a weak password, it won't remove malware already on your site and it won't fix an outdated plugin. The padlock means the connection is private, not that the whole site is safe. It is an essential piece, but only one of several.
Certificate types: DV, OV and EV
All certificates encrypt the connection the same way. What changes is how much is verified before they are issued:
| Type | What is verified | Typical use |
|---|---|---|
| DV (domain validation) | Confirms that you control the domain. | Brochure sites, blogs, small online stores. |
| OV (organization validation) | Also checks that your company legally exists. | Businesses that want their identity shown in the certificate. |
| EV (extended validation) | A stricter review of the company and its details. | Organizations with formal compliance requirements. |
For most small businesses a DV certificate is enough: visitors see the same padlock and the connection is just as protected. Many hosting plans include one and install it automatically.
There are also wildcard certificates, which cover every subdomain of a domain, such as shop.yourbusiness.com and blog.yourbusiness.com, with a single certificate.
Automatic renewal
Certificates are not permanent: they have an expiry date, and their lifetime keeps getting shorter because that limits the damage if something is ever compromised. When a certificate expires, the browser shows a full-page warning, and most people never get past it.
That is why renewal should be automatic. In control panels like cPanel, the server can request and renew the certificate on its own, as long as the domain points correctly to the hosting. If you change your DNS or move your domain, make sure renewal still works; if you are unsure how a domain is pointed, read what DNS is.
Mixed content: when the padlock is missing
Sometimes the certificate is installed but the browser still doesn't show a clean padlock. The most common cause is mixed content: the page loads over HTTPS, but an image, script or file is still requested from an http:// address.
To fix it:
- Change your site address to https:// in your content management system settings.
- Update internal links and images that still point to http://.
- Set up a redirect so every visit to http:// goes to https://.
- Check the browser console or an online mixed content checker.
If you use WordPress, this is part of a solid security baseline; we cover it alongside other measures in WordPress security.
Frequently asked questions
In practice, yes. TLS is the modern version of SSL, but people still say SSL when talking about the certificate.
Yes. Browsers flag any site without HTTPS as not secure, and contact forms handle personal data too.
No. The encryption is the same; what changes is how much the company’s identity is checked before the certificate is issued.
HostSpace team
We provide hosting, domains, VPS servers and business email with Spanish-speaking support. We write about what our customers ask us most.