The short answer: HTTPS makes the connection between your visitors and your website private and tamper-proof, and the padlock in the address bar shows that the site is the real one. For years a certificate cost money and took effort, so most small business websites skipped it. This month, free certificates from Let's Encrypt came out of beta, and many hosting companies and services now offer free options, so there is very little reason left to stay on plain HTTP. Switch carefully, with proper redirects, and everything else stays the same.
You have seen the padlock on your bank's website, and on online shops when you pay. Now look at the address bar of most small business websites in Bangladesh. They begin with http://, with no padlock at all.
Until recently that was understandable. A certificate was an extra cost, the setup was technical, and the website worked perfectly well without it. That has changed. On 12 April 2016, Let's Encrypt, a free certificate service, moved out of its test period and became an official, fully launched service.
This article explains what HTTPS is in plain words, why your business website should use it, the options for getting a certificate, and how to move your site without losing visitors or your Google results.
What Is HTTPS (and SSL)?
HTTP is the language that web browsers and websites use to talk to each other. HTTPS is the same conversation with a lock on it. It uses a technology called SSL, or more precisely TLS, which is why people say "SSL certificate."
HTTPS does two jobs:
- It encrypts the connection. Anyone who sits between your visitor and your website, such as another person on the same café Wi-Fi, cannot read or change the information being sent.
- It confirms who you are talking to. The certificate proves that the visitor reached the real domain, not a copy of it.
You can see it in the address bar: the address begins with https:// and a padlock appears.
Two things HTTPS does not do. It does not prove that a business is honest, and it does not protect a website from hackers. A site with weak passwords or old software can still be broken into, even with a padlock.
Why Your Business Website Needs HTTPS
1. It protects your visitors' information
Every contact form, login box and order form sends information from the visitor's phone or computer to your server. On plain HTTP, that information travels in a form that others on the same network can read. If your website asks for names, phone numbers, email addresses or passwords, HTTPS is the minimum protection you owe your customers.
2. It stops your pages from being changed on the way
On plain HTTP, a network between the visitor and your website can alter a page before it arrives, for example by inserting adverts or other content. HTTPS prevents that, so your visitors see exactly what you published.
3. It builds trust
Many customers look for the padlock before they enter any details. Browser makers are also moving in this direction. In April 2015, Mozilla, the maker of Firefox, announced its plan to phase out non-secure HTTP over time. Sites that do not move may look increasingly out of date.
4. Google uses it as a ranking signal
In August 2014, Google announced that HTTPS is a ranking signal. It described the signal as very light: at the time it affected fewer than 1% of searches worldwide, and it carried less weight than the quality of your content. Google also said it might strengthen the signal over time. So do not expect a jump in rankings, but it points clearly in one direction.
5. It unlocks faster page loading
The newer HTTP/2 technology, which can load pages faster, is used by browsers only over HTTPS. Not every hosting company supports it yet, so ask yours, but moving to HTTPS is the first step.
6. It keeps your visitor statistics accurate
When someone clicks from an HTTPS page (Google's search results are HTTPS) to a plain HTTP website, the browser does not pass on where the visitor came from. In Google Analytics, many of those visits then appear as "direct" traffic. On an HTTPS site, you keep that information and can see which sources really bring customers.
7. Browsers are starting to limit features to secure pages
Some browser features, such as sharing a visitor's location, are being restricted to secure pages. If you plan to use them one day, HTTPS will be required.
What Is Let's Encrypt?
Let's Encrypt is a free service that issues SSL certificates. It is run by the Internet Security Research Group, a non-profit organisation, and backed by organisations including Mozilla, the Electronic Frontier Foundation, Cisco and Akamai.
Here is what you need to know:
- It is free. There is no charge for the certificate.
- It is automated. The certificate can be requested and renewed by software, without paperwork.
- It is trusted. Its certificates are accepted by all the major browsers.
- It is new. A public beta began in December 2015, and the service left beta on 12 April 2016.
- Certificates last 90 days. They must be renewed automatically, otherwise they will expire.
There are limits as well. You need a hosting company or server that supports it, and on shared hosting that depends on your host. The certificate proves that you control the domain, which is enough for most business websites, but it does not display your company's details the way a more expensive certificate can.
Your Options for Getting a Certificate
| Option | Cost | Good for | Watch out for |
|---|---|---|---|
| Free certificate from Let's Encrypt | Free | Most small business websites | Needs host support or server access, and automatic renewal every 90 days |
| Certificate from your host or a certificate company | A yearly fee | Owners who want someone else to install and manage it | Check the renewal price, and make sure it covers both www and non-www |
| Cloudflare's free plan (Universal SSL) | Free | A quick way to get HTTPS on many websites | Changes how your domain is set up. In "Flexible" mode, only the first part of the journey is encrypted, so use "Full" if your own server also has a certificate |
| Organisation or Extended Validation certificate | Higher yearly fee | Banks, large online shops and companies that want their name shown | More paperwork and cost than a small site needs |
For most small business websites, a free or low-cost standard certificate is enough. Ask your hosting company first. They may already offer it.
How to Move Your Website to HTTPS
- Get and install the certificate. Ask your host, or your developer, to install it on your domain. Make sure it covers both yourbusiness.com and www.yourbusiness.com.
- Test it. Open your site with https:// in front of the address. You should see the padlock.
- Fix mixed content. If a secure page loads an image, script or style file from an http:// address, the browser will show a warning and the padlock may disappear. Change those links to https:// (or to relative links). On WordPress, set both the WordPress Address and the Site Address to https:// in Settings, then use a search-and-replace tool to update old http:// links in your content.
- Redirect HTTP to HTTPS. Set up a permanent (301) redirect, so that anyone who uses an old link, bookmark or Google result lands on the secure page. This also stops Google from seeing two copies of your site.
- Update everything that points to your site. This includes canonical tags, your XML sitemap, internal links, social media profiles, advertisements, your email signature and the default URL in Google Analytics.
- Tell Google. In Google Search Console, add the https:// version of your site as a new property, because Google treats HTTP and HTTPS as separate sites. Then submit your sitemap.
- Test everything. Check your main pages, forms and any login or checkout on a computer, a phone and more than one browser.
- Plan renewal. If your certificate lasts 90 days, make sure it renews automatically, and put a reminder in your calendar to check.
Common Mistakes
- A missing padlock because of mixed content. One insecure image can spoil the whole page.
- No redirect. Without it you have two versions of your site, and visitors and Google can end up on either.
- A certificate that covers only one version of the address. If it does not cover www, visitors who use it will see a warning.
- Letting the certificate expire. Browsers then show a full-page warning such as "Your connection is not private", and most visitors leave immediately.
- Redirect loops. If you use Cloudflare's Flexible mode and also force HTTPS on your own server, the page may fail with a "too many redirects" error.
- Forgetting Google Search Console. If you do not add the new version, you will not see its search data.
- Believing the padlock means the site is hack-proof. Keep your software updated and your passwords strong.
A Quick HTTPS Checklist
- A certificate is installed for both the www and non-www addresses
- The padlock appears on every page, with no mixed-content warnings
- All http:// addresses redirect permanently (301) to https://
- Internal links, sitemap and canonical tags use https://
- The HTTPS version is added to Google Search Console and the sitemap is submitted
- Google Analytics uses the https:// address
- Forms, logins and checkout have been tested on a phone and a computer
- Automatic renewal works, and the expiry date is in the calendar
Frequently Asked Questions
Is HTTPS only for online shops and banks?
No. Any website with a contact form, a login or a customer-facing page benefits. Even a simple brochure website is better protected and more trusted with HTTPS.
Will HTTPS slow down my website?
The extra work is small on a modern server, and the speed gains from HTTP/2 can make up for it. A well-configured HTTPS site is usually not noticeably slower.
Is a free certificate as secure as a paid one?
The encryption is the same strength. The differences are in how much the certificate authority checks about your business, how long the certificate lasts and what support or guarantees come with it. For most small websites, a free standard certificate is enough.
Will I lose my Google rankings if I switch?
Done properly, the move normally goes smoothly. Use permanent 301 redirects, update your sitemap, and add the new version to Google Search Console. A small, temporary change in your results is possible while Google processes the change.
Do I need a dedicated IP address?
Not usually. Modern servers and browsers can share one address using a feature called Server Name Indication. A few very old browsers and phones do not support it, so ask your host if your customers might use them.
What should I do if my host does not offer SSL at all?
Ask whether they plan to, and look at other options such as Cloudflare's free plan. If a host cannot support HTTPS at all, it may be time to think about moving to a better one.
Need Help Moving to HTTPS?
If you would like your website moved to HTTPS properly, with the certificate, redirects, mixed-content fixes and Google settings all taken care of, I can help. I design and develop websites for businesses and I will explain every step in plain language. Send me a short message with your website address.
