SSL Certificates Explained: HTTPS Without the Jargon
The padlock in your browser's address bar means the connection to the website is encrypted and the browser has checked that it is talking to the real site for that domain. That protection comes from TLS, the modern version of what most people still call SSL, and from a digital document called a certificate. Today every website should use HTTPS, even a simple blog with no forms.
Why HTTPS matters for every site
- Privacy. Without encryption, anyone on the same network, such as public Wi-Fi, can read or alter the pages and form data passing between visitor and site.
- Integrity. Encryption prevents networks from injecting ads or scripts into your pages.
- Trust. Major browsers label plain HTTP pages "Not secure", which scares visitors off, especially on pages with forms.
- Features. Many modern browser features only work on HTTPS pages, and HTTP/2 and HTTP/3 performance improvements are used over encrypted connections.
- Search. Google has said HTTPS is a lightweight ranking signal.
How it works, briefly
When your browser connects to an HTTPS site, the server presents its certificate. The certificate says, in effect, "this public key belongs to example.com", and it is digitally signed by a certificate authority (CA) that browsers already trust. The browser checks the signature, the domain name and the expiry date. If everything matches, browser and server agree on temporary encryption keys and the rest of the visit is encrypted.
The private key that matches the certificate stays on the server and should never be shared. If it leaks, the certificate should be revoked and replaced.
Types of certificates
- Domain Validated (DV): the CA only checks that you control the domain, usually automatically through a DNS record or a file on the site. This is what most websites use, and it provides the same strength of encryption as any other type.
- Organization Validated (OV): the CA also checks that the organization named in the certificate exists.
- Extended Validation (EV): a stricter organization check. Browsers used to show a green bar with the company name for EV, but they no longer display it prominently, so EV has lost most of its visible benefit for ordinary sites.
Certificates can also cover different sets of names. A single-name certificate covers one hostname. A multi-domain (SAN) certificate lists several. A wildcard certificate covers every first-level subdomain, such as *.example.com.
Free certificates are normal now
You do not need to pay for a certificate for a typical website. Let's Encrypt, a nonprofit CA, issues free DV certificates, and many hosts and platforms issue and renew them for you automatically. Cloudflare, most shared hosts and nearly all static hosting services include free certificates. Paid certificates mainly make sense when you need OV or EV validation for a business or compliance reason, or a warranty that some buyers ask for.
Free certificates have short lifetimes, typically 90 days, and are designed to be renewed automatically. The industry is moving toward shorter certificate lifetimes overall, so automation matters more every year. If your host does not renew certificates automatically, that is a reason to consider another host.
Setting up HTTPS on a site
On most hosts, setup is a switch in the control panel. The usual steps:
- Point your domain at the host and wait for DNS to update.
- Turn on the free certificate in the control panel. The host proves domain control and installs it.
- Redirect all HTTP traffic to HTTPS, so visitors and search engines always use the secure version.
- Update the site's own settings (in WordPress, the site URL) to use https://.
- Fix any mixed content, described below.
Once everything works reliably on HTTPS, you can consider HSTS, a header that tells browsers to always use HTTPS for your domain. Start with a short max-age while testing, because HSTS is hard to undo quickly if something breaks.
Common errors and what they mean
- Mixed content. The page is HTTPS but loads images, scripts or styles over HTTP. Browsers may block those files or remove the padlock. Change the links to https:// or to relative paths.
- Certificate name mismatch. The certificate does not include the name in the address bar, often because it covers example.com but not www.example.com. Add both names.
- Expired certificate. Automatic renewal failed, frequently because DNS moved or a validation file was blocked. Check the renewal logs in your host's panel.
- Too many redirects. Common when a CDN or proxy talks to your server over HTTP while the server redirects to HTTPS, and the two keep bouncing. With Cloudflare, setting the SSL mode to "Full (strict)" with a valid certificate on the origin usually fixes it.
- Untrusted certificate. A self-signed certificate or a missing intermediate certificate. Install the full chain your CA provides.
The short version
HTTPS encrypts traffic between visitors and your site and proves the site is who it says it is. A free, automatically renewed DV certificate is right for almost every site. Turn it on, redirect HTTP to HTTPS, fix mixed content, and make sure renewals are automated. For the DNS side of setup, see DNS basics.