Why Your Website Needs HTTPS

Summary: HTTPS is the padlock in the address bar, and a site without it now gets an explicit “Not secure” warning in every major browser. It matters for three separate reasons: it stops anything typed into your site being read in transit, it is a confirmed Google ranking signal, and its absence visibly frightens customers. This guide covers what it does and does not protect, why certificates are free, what mixed content is and why it breaks the padlock, and how to check yours is set up properly.

What HTTPS actually does

It encrypts the connection between a visitor’s browser and your server, so anything sent either way — a contact form, a password, a card number, or simply which pages someone read — cannot be read by anything sitting in between. That includes the coffee shop wi-fi, the network operator, and anyone else on the same connection.

It also verifies that the server answering is genuinely yours, which is what makes it hard to impersonate your site on a network you do not control.

What it does not do is make your website secure. That is a common and expensive misunderstanding. HTTPS protects data in transit. It does nothing about an out-of-date plugin, a weak password or a vulnerability in your code — which is how sites actually get compromised, and what clean-up work deals with.

Three reasons it is not optional

Browsers say so out loud. Chrome, Firefox, Safari and Edge all mark plain HTTP pages “Not secure” in the address bar. On a page with a form, some go further with a full-page interstitial. Whatever the technical reality, a customer reading a security warning on your quote form does not fill it in.

Google uses it as a ranking signal. Confirmed since 2014. It is a small factor and it will not lift a weak site, but between two otherwise similar pages it is a tiebreaker you have no reason to lose.

Analytics stop making sense without it. Traffic arriving from an HTTPS site to an HTTP one loses its referrer information, so a chunk of your traffic shows up as “direct” and you cannot tell where it came from.

You should not be paying for this

Certificates have been free since Let’s Encrypt launched in 2015. Effectively every reputable Canadian host now provisions and renews one automatically at no charge, and the renewal is the part that matters — expired certificates produce a much scarier warning than never having had one.

If your host is billing you $80 a year for an SSL certificate on an ordinary business website, ask why. There are narrow cases for a paid certificate — an organisation-validated certificate for a bank, a wildcard covering many subdomains — but a brochure site or a small online store is not one of them.

Mixed content: the reason the padlock is missing

Installing the certificate is the easy half. The usual snag is mixed content: the page loads over HTTPS but still pulls an image, a stylesheet or a script over plain HTTP. Browsers then either drop the padlock or block the resource, so the site looks broken or insecure despite the certificate being fine.

It happens because old content contains hard-coded http:// addresses — images inserted years ago, an embedded map, a font from a third party. Finding them means searching the database and the theme files for those addresses and updating them, not just flipping a setting.

Getting the redirect right

Once the certificate is live, every HTTP address must send visitors to its HTTPS equivalent with a permanent redirect, and the same applies to the www and non-www versions of your domain. Skip this and you have several copies of your site at different addresses, which splits your search standing across all of them.

The whole job is one rule in .htaccess on most hosts. Getting it wrong is easy — a careless rule can loop and take the site down — so it is worth testing rather than assuming.

How to check yours

1. Load your site and confirm the padlock is there with no warning.
2. Type the plain http:// address and confirm it redirects rather than loading.
3. Try it with and without www — both should end at the same address.
4. Open a few inner pages, particularly older blog posts, and check the padlock survives. Mixed content usually hides on old content, not the homepage.
5. Check the expiry date. Automatic renewal is normal now, but it does occasionally fail silently.

All five are part of routine website maintenance, and the certificate expiry is exactly the sort of thing monitoring exists to catch before your customers do.

Common questions