SSL certificates explained: do you need to buy one?

The short version

• An SSL certificate lets your site load over HTTPS, the encrypted version of your web address. Without one, browsers label your site “Not secure.”
• Most small-business sites never buy one. Website builders, the major web hosts and Cloudflare’s free plan include a free certificate that renews itself.
• Certificates now expire faster: 200 days at most today, 47 days from March 15, 2029. Automatic renewal matters more than the brand of certificate.
• Paying makes sense mainly when you want your verified business name inside the certificate. Browsers barely show it anymore.

What the padlock and “Not secure” mean

HTTPS encrypts what travels between a visitor’s browser and your site, and the certificate proves the browser reached your real domain. Chrome Help says “Not secure” means the site does not use a private connection, so others may be able to see or change data sent through it. Firefox shows a padlock on encrypted sites and a padlock with a red strike on plain HTTP. Chrome swapped its padlock for a “tune” icon in Chrome 117 (early September 2023), so no padlock in Chrome is normal. As of October 2026, Chrome 154 also asks visitors by default before it opens a public site without HTTPS.

Most sites never buy one

On a website builder, the certificate is part of the plan:

• Squarespace, Shopify, WordPress.com and GoDaddy’s website builder add a free certificate automatically.
• Wix and Webflow add one automatically too, once you connect your own domain. That needs a paid plan on both.

On web hosting, all 10 hosts in our web hosting guide list free SSL. Two details to check: Bluehost’s help page says you must activate its free certificate yourself, and GoDaddy’s Economy hosting plan includes a free certificate for 1 year only (Deluxe and Ultimate include unlimited free SSL).

Many of these free certificates come from Let’s Encrypt, a certificate authority (CA, the company that issues certificates) that does not charge for them.

Cloudflare, which many sites put in front of their host, includes a free certificate (Universal SSL) on every plan, Free included. If you use it, choose the Full (strict) encryption mode. Flexible mode talks to your host over plain HTTP, which can cause a “too many redirects” error.

Certificates now expire faster

The CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules, caps how long a certificate can last:

• Before March 15, 2026: 398 days
• From March 15, 2026: 200 days
• From March 15, 2027: 100 days
• From March 15, 2029: 47 days

Apple proposed the change, and Apple, Google, Microsoft and Mozilla all voted yes in the vote that closed April 11, 2025. Let’s Encrypt certificates already last 90 days, and its default drops to 64 days from February 10, 2027.

What this means for you: with a builder or host that renews for you, nothing changes. With a certificate you bought and installed by hand, you repeat the install every few months. Namecheap, for example, says its certificates should be reissued (free) every 200 days. Miss one and browsers warn visitors that the certificate has expired.

Which certificate do I need?

The industry rules say every certificate type gives the same assurance about the domain name. The types differ only in how much the CA checks about the owner. DV (Domain Validated) checks only that you control the domain. OV (Organization Validated) and EV (Extended Validation) also verify your business.

Card security rules (PCI DSS) are a separate matter from which certificate you buy. Paid OV and EV prices vary widely. For example, Namecheap’s High Assurance SSL (OV) is $35.99 for one year, and GoDaddy’s EV SSL is $10.42 a month with a 3-year term.

A wildcard certificate covers one level of subdomains: *.example.com covers www.example.com but not a.b.example.com or example.com itself. A multi-domain (SAN) certificate lists several names. Both are explained in the types guide.

Check your own site in two minutes

1. Open your site with https:// in front, for example https://example.com.
2. Look left of the address. “Not secure” or a padlock with a red strike means the page did not load over HTTPS.
3. Click that icon to open the site’s details. In Firefox, choose “Connection secure,” then “More information.” The Security tab shows which certificate authority verified the site, and “View Certificate” opens the certificate itself.
4. Also try http://example.com and https://www.example.com. Each should end up on the secure version of your site.
5. If something fails, go to the SSL error fixes. Most fixes are one setting at your host, builder or DNS provider.

The five SSL guides

• Types of SSL certificate: DV, OV and EV; single, wildcard and multi-domain; what the CA checks and what visitors see.
• Free vs paid SSL: Let’s Encrypt, ZeroSSL and Cloudflare against DigiCert, Sectigo, GoDaddy and Namecheap, with renewal prices and what a warranty pays.
• SSL by platform: what each builder and the 10 hosts include, and the Cloudflare settings.
• Fix SSL errors: “Not secure,” expired certificates, name mismatch, redirect loops and mixed content, step by step.
• Hire help with SSL: when it is worth it, what to ask, and how to give access without sharing your password.

Sources: CA/Browser Forum: Baseline Requirements, Ballot SC-081v3. Google: Chrome Help on “Not secure”, lock icon update, Chrome 154 release notes, EV display change. Mozilla: Firefox connection security, Site Information panel, Page Info window. Let’s Encrypt: FAQ, 64-day certificates. Cloudflare: Universal SSL, encryption modes, too many redirects. Stripe: Checkout. Builders and hosts: Wix, Squarespace, Shopify, WordPress.com, Webflow, GoDaddy website builder, Bluehost, GoDaddy hosting. Prices: Namecheap High Assurance SSL, GoDaddy EV SSL.