# Do I Need an SSL Certificate for My Website? > Yes, and you almost certainly already have one for free without knowing it. Here is how to check in two minutes and how to switch it on if it is missing. *Roald, Founder Fonzy · Aug 26, 2026 · 7 min read* Source: https://www.fonzy.ai/blog/do-i-need-ssl-certificate --- **Short answer:** Yes, your small business website needs an SSL certificate, and you very likely already have one for free through your website builder or host. It is the thing that puts the padlock and "https" in front of your web address and encrypts what visitors type. Your real task is a two-minute check, not a purchase. Picture a bakery that launched its site on Wix last spring. The owner never touched a setting called "SSL." She never bought a certificate. And yet the day the site went live, the little padlock was already sitting in her browser's address bar. That padlock was proof the whole thing was already handled. She just never knew to look for it. That is the situation most owners are in. So before you go shopping for something a vendor is trying to sell you, let us walk through what this actually is, how to confirm you already have it, and what to do in the rare case you do not. ## What an SSL certificate really is, in plain words An SSL certificate is the thing that turns "http" into "https" and puts a padlock next to your web address. That is it. Behind the scenes, it encrypts the connection between your website and the person visiting it, so anything they type, a name, an email, a phone number, a card, travels scrambled instead of in the open. Google's own security team put the stakes in one sentence: "When you load a website over plain HTTP, your connection to the site is not encrypted." Translate that for a bakery: without HTTPS, a customer's order details travel in plain view of anyone watching the connection. The certificate is what closes that gap. You do not need to understand the math. You need to understand the outcome. Padlock and "https" means protected. No padlock and "http" means exposed, and browsers now say so out loud. ## Do I actually need one for a small business website? Yes. This is not one of those "nice to have someday" items you can push down the list behind a logo redesign. Two things make it non-negotiable, and both affect real customers landing on your page. The first is what visitors see. Since its July 2018 release, Chrome marks every site that is not encrypted with HTTPS as "Not Secure" to all Chrome users, according to Google's own announcement on the Chrome blog. That label shows up right in the address bar, on the page a stranger opens when they are deciding whether to trust you with a booking. The second is search. Google has confirmed it uses HTTPS as a ranking signal. So a certificate is not a marketing extra. It is the baseline a plumber, a salon, or a corner shop needs before anything else works the way it should. This sits alongside the other things that decide whether a first-time visitor believes you, which we cover in our guide on how to [make your website trustworthy](/blog/make-website-trustworthy). ## What happens if you skip it: the "Not Secure" warning Here is the scene without a certificate. Someone hears about your shop, types your name into Google, taps your link, and the browser greets them with "Not Secure" before they read a single word you wrote. They do not know what SSL is. They do not care about encryption. They see a warning, and warnings make people leave. That is the whole cost. Not a fine, not a takedown, just a quiet stream of visitors bouncing off a scary label at the exact moment you wanted them to book. For a business where one lost customer is a real chunk of the week, that is expensive. And it is entirely avoidable, usually with no money and no code. ## Does an SSL certificate help my Google ranking? A little, and it is worth being honest about how little. When Google announced HTTPS as a ranking signal, it described it as "a very lightweight signal, affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content." Google also said it gives site owners time to switch, rather than punishing them overnight. So do not install a certificate expecting to jump three spots on Google. Install it because it is the floor, and because everything else you do to rank works better on a secure site. If you are weighing which technical fixes actually move the needle, our breakdown of [website speed as a ranking factor](/blog/website-speed-seo) covers a signal that carries more weight than HTTPS does. The mental model: content and reviews win you rankings. HTTPS just makes sure you are allowed on the field. ## How to check if your site already has one This is the two-minute task the whole article builds to. You do not need a tool or a login. You need your own browser. Open your website the way a customer would. Then look at three things, in order: - Look at the address bar for a padlock icon next to your web address. If it is there, you have SSL. - Read the front of your address. If it starts with "https," you are encrypted. If it starts with plain "http" with no "s," you are not. - Type your address by hand with "https://" in front and press enter. If the page loads normally with a padlock, your certificate is live. Do this now, before you read further. Most owners find the padlock already sitting there, exactly like the Wix bakery did, and the rest of this article becomes a "good, nothing to fix" confirmation. If your address bar shows the padlock and "https," you are done. You have what a certificate provides, and you never had to buy a thing. ## Do I have to buy one, or is it free? Almost certainly free. This is the part SSL vendors would rather you not hear. Modern website builders and hosts include a certificate and switch it on automatically. Squarespace, for example, automatically protects every domain that is correctly pointed to a Squarespace site with a free SSL certificate, according to its own help center, so owners on that platform never buy or install anything. Wix, Shopify, and most mainstream hosts work the same way. And even outside those platforms, free is the standard. Let's Encrypt, a nonprofit certificate authority run by the Internet Security Research Group, hands out free SSL certificates specifically so any website owner can turn on HTTPS at no cost. It exists so that "you have to pay for security" is simply not true anymore. So when a certificate reseller quotes you a yearly fee, treat it the way you would treat a mechanic charging for air. Sometimes a paid certificate makes sense for large or specialized setups. For a normal small business site, it rarely does. If you are budgeting a new site, our rundown of [what a small business website actually costs](/blog/small-business-website-cost) will keep this line item in perspective. Running an owner-run site all day, the pattern we see over and over is this: the owner is bracing to pay for something they already own. They opened this page expecting a bill, and the honest answer is a free two-minute check. The purchase they were about to make was never necessary. ## How to turn it on if your site does not have one Say you did the check and there was no padlock. Here is the path, and it is short. If you are on a builder like Wix, Squarespace, or Shopify, the certificate is almost always included and just needs to finish activating, which can take a little time after you first connect your domain. Look in your site settings for an SSL or HTTPS option and make sure it is switched on. If it is on and still not working, the problem is usually the domain, which we get to next. If you are on WordPress or a self-managed host, ask your host to enable a free Let's Encrypt certificate, or find the "SSL" or "HTTPS" toggle in your hosting control panel. Nearly every host offers this, and most do it with one click at no charge. Either way, the instruction to your platform or host is the same simple sentence: "Please make sure my site has a free SSL certificate turned on." You do not need to know the mechanics. You need to know it exists and that you can ask for it. ## Common reasons a site still says "Not Secure" and how to fix them Sometimes the certificate is on but the warning stays. Two culprits cause most of these, and neither means you did anything wrong. The first is a domain that is not pointed correctly. A free certificate only covers a domain that is properly connected to your site, which is exactly the condition Squarespace names when it protects domains "correctly pointing to" a Squarespace site. If you recently changed hosts or bought a new domain, the pointing may not have finished. The fix is to confirm your domain settings match what your platform tells you to use, then wait for it to catch up. The second is mixed content. This happens when your page loads over "https" but still pulls in an old image, font, or script over plain "http." The browser sees one insecure piece and flags the whole page. The fix is to find and update those old "http" links, usually images added years ago, so everything loads securely. Your platform's support docs, or a quick note to your host, will point you to the exact spot. This is the same kind of routine site hygiene we cover in our [small business website checklist](/blog/small-business-website-tips), right next to making sure your pages [work properly on a phone](/blog/is-my-website-mobile-friendly). ## Frequently asked questions ### Is SSL the same thing as HTTPS? They are two halves of the same thing. The SSL certificate is the credential your site holds, and HTTPS is the secure connection it makes possible. When people say "get an SSL certificate" and "switch to HTTPS," they mean the same practical result: a padlock in the address bar. ### Will an SSL certificate slow down my website? No, not in any way a visitor would notice. Encryption adds a tiny amount of work, but modern browsers and hosts handle it so efficiently that the difference is invisible. Your load time is shaped by images and code far more than by the certificate. ### How often do I have to renew it? If your builder or host manages it, which most do, renewal is automatic and you never think about it. Free certificates from services like Let's Encrypt renew on a short cycle behind the scenes. You only deal with renewal manually if you bought and installed a certificate yourself, which most small businesses never need to do. ### My site is just information, no payments. Do I still need one? Yes. Even a site that only lists your hours and phone number gets the "Not Secure" label in Chrome without HTTPS, and that warning scares off visitors regardless of whether you take payments. The certificate protects trust, not just transactions. ## The two-minute check beats the yearly bill Go back to that bakery owner and her padlock. She spent months assuming website security was a thing she had failed to buy, when it had been switched on since day one. The moment she learned to glance at her own address bar, the worry vanished. Nothing to purchase, nothing to install, just proof already sitting there. That is the quiet win most owners are one look away from. And it is the same spirit behind how Fonzy handles the technical groundwork of getting found: check what is already working, fix the small thing that is not, and spend your energy on the customers instead of the plumbing. ## Sources - [Google Search Central Blog: HTTPS is a lightweight ranking signal affecting fewer than 1% of queries](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal) - [Google (The Keyword): Chrome marks all non-HTTPS sites "Not Secure" as of its July 2018 release](https://blog.google/products/chrome/milestone-chrome-security-marking-http-not-secure/) - [Let's Encrypt: a nonprofit certificate authority providing free SSL certificates to any website owner](https://letsencrypt.org/) - [Squarespace Help Center: free SSL is applied automatically to domains correctly pointing to a Squarespace site](https://support.squarespace.com/hc/en-us/articles/205815898-Understanding-SSL-certificates) --- Published by [Fonzy](https://www.fonzy.ai) — expert articles that get you found on Google and AI search.