SSL Certificates Explained: What They Do and How to Set One Up

You have probably seen a padlock beside a website address, or a warning that a site is "not secure". Both come from an SSL certificate, or more precisely a TLS certificate, which is the modern version of the same technology. Most people still say SSL.

This SSL certificate explained guide covers what the certificate does, the types you can buy, how to install and renew one, and how to fix the warnings that scare visitors away. It is written for business owners, school and church administrators and anyone who manages a site without a technical team.

What an SSL certificate does

When a visitor opens a page, their browser and your server need to agree how to talk securely. A certificate makes that possible in two ways.

• Encryption. Data sent between the visitor and the site, such as names, phone numbers, emails and passwords, is scrambled so others on the same network (for example public Wi-Fi) cannot read it.
• Identity. A certificate authority has checked that whoever requested it controls the domain, so the visitor reaches the real site rather than an imitation.

SSL is the older name; the protocol in use today is TLS. Hosting companies and browsers still say SSL, so we use it here.

Why an SSL certificate matters for your business

Visitor trust

Browsers label sites without a valid certificate as not secure, and many visitors leave when they see this. Anyone filling in an enquiry form, booking an appointment or paying for something expects the padlock.

Search and ads

Google has said for years that HTTPS is a lightweight ranking signal. It will not rescue a weak page, but running on http is a needless disadvantage. Our technical SEO work always includes checking HTTPS. Landing pages for paid campaigns should also load securely so visitors do not hit a warning after clicking an ad.

Data protection

If your site collects personal details, encryption in transit is a basic safeguard. India's Digital Personal Data Protection Act 2023 expects reasonable security safeguards for personal data. A certificate is only one part of that, but a site without one is hard to defend.

HTTP vs HTTPS: what changes

A site with a valid certificate loads on https://. Without one it loads on http://, which is unencrypted. After you install a certificate, the site should do three things:

• Redirect every http address to its https version with a permanent (301) redirect.
• Use the https address everywhere: internal links, canonical tags, sitemap and social profiles.
• Show the padlock with no warnings on every page, including old posts and landing pages.

Also update the property in Google Search Console and your analytics settings if the address changed.

Types of SSL certificates

Certificates differ in how much checking the authority does and how many domains they cover.

Single, wildcard and multi-domain

A single-domain certificate covers one address. A wildcard certificate covers a domain and all its subdomains (for example blog.yourbusiness.in and shop.yourbusiness.in). A multi-domain certificate covers several different domains.

Free or paid

Free DV certificates, such as those issued by Let's Encrypt, provide the same strength of encryption as paid DV certificates. Many hosts install them automatically. Paid certificates can add warranty, organisation validation or support, which some organisations value. For a typical small business site, a free automatic DV certificate is sensible.

How to install an SSL certificate

1. Check your host. Many hosting panels, including cPanel, can issue and install a certificate with a few clicks. Look for "SSL/TLS" or "AutoSSL".
2. Issue or upload the certificate. Choose the domain, including the www version, and complete validation. If you bought a certificate elsewhere, you will install the files the issuer provides.
3. Switch the site address to https. In WordPress, update the Site Address and WordPress Address under Settings, General.
4. Force https. Add a 301 redirect from http to https at server level or through your hosting panel.
5. Fix mixed content. Replace any image, script or stylesheet still loading over http.
6. Test every key page. Check the home page, contact form, checkout and landing pages for the padlock.

If your host does not offer SSL, that is a reason to reconsider; see our guide on how to choose website hosting.

Fixing mixed content and not secure warnings

Mixed content happens when a secure page loads some files over plain http. Browsers may block those files or show a warning, even though the certificate is valid.

Common causes

• Old images inserted with http addresses in posts or page builders.
• Hard-coded http links in theme files or custom code.
• Third-party scripts, fonts or embeds that use http.

How to find and fix them

Open the page, use your browser's developer tools and check the Console for mixed content messages. On WordPress, a search-and-replace tool can update old http addresses in the database; take a backup first, using our website backup guide. If the browser says the certificate itself is invalid, the cause is usually an expired certificate, a name mismatch (for example the certificate covers the non-www address only) or an incomplete certificate chain.

SSL certificate renewal: do not let it expire

Certificates have a limited life, and industry rules have been shortening the maximum lifetime over time, so check the current documentation from your provider. The practical lesson is to automate renewal. An expired certificate shows visitors a full page warning, and most will not click through.

• Turn on auto-renewal in your hosting panel or certificate provider.
• Use a monitored email address for renewal notices.
• Add a calendar reminder for paid certificates.
• Set an uptime or certificate monitor that alerts you before expiry.
• After any server migration, confirm the certificate still renews.

How to check your SSL certificate

Open your site on a phone and a computer, and click the padlock or site information icon beside the address. The browser shows whether the connection is secure, who issued the certificate and when it expires. Check both the www and non-www versions, and try a few inner pages, not only the home page.

Free online SSL checkers can also test the full certificate chain and flag weak configuration. If you manage several sites, such as a main site and a landing page subdomain, check each one, because each needs coverage. Include the certificate date in your regular site checks alongside backups and updates, which our website backup guide describes.

Frequently asked questions

Conclusion

An SSL certificate is a basic requirement for any business site. Install it, redirect everything to https, fix mixed content and automate renewal. If you would like us to check your setup, get in touch and we will review it and fix any problems.