What an SSL certificate actually does
Without a certificate the site runs over HTTP and data between the visitor’s browser and the server travels in clear text. Anyone technically able to intercept the traffic in transit — on public Wi-Fi in a café or an airport, at the provider level, or on compromised network equipment — can read it without much effort. An SSL certificate enables HTTPS: the connection is encrypted, and intercepted data becomes a meaningless string without the secret key an outside observer does not hold.
This covers more than passwords and card numbers typed into forms — the entire traffic is encrypted, including which pages a visitor opens and what they do on them.
What a visitor sees without SSL
Modern browsers mark HTTP sites as “not secure” right in the address bar. That warning is visible to every visitor before the page has even rendered, shaping the first impression of the company before anyone reads a word of content. On pages with input fields — an enquiry, a payment, a login — the warning is harsher still, and some visitors simply close the tab.
With and without, side by side
| Aspect | With SSL (HTTPS) | Without SSL (HTTP) |
|---|---|---|
| Browser indicator | padlock, “connection is secure” | “not secure”, warning in the address bar |
| Form data | transmitted encrypted | transmitted in clear text |
| Search rankings | HTTPS counts as a positive signal | at a disadvantage, all else being equal |
| Payment integrations | required by every provider | not accepted |
What to check
- •The certificate is valid and renews automatically,
- •HTTP redirects to HTTPS rather than serving both,
- •No mixed content — images and scripts loaded over plain HTTP on a secure page,
- •Expiry is monitored, so nobody finds out from a customer.
It belongs in the wider server review — see the server security audit checklist.
Frequently asked questions
How is HTTPS different from HTTP?
HTTP sends data between browser and server in clear text, where it can be intercepted and read in transit — on public Wi-Fi, for instance. HTTPS encrypts that connection using an SSL certificate, so intercepted data is meaningless without the decryption key, which an observer does not have.
Do we need SSL if the site has no forms or payments?
Yes. Even with no forms, browsers mark HTTP sites as “not secure” in the address bar — every visitor sees it and some leave at that point. Search engines also treat HTTPS as a signal, so a site without a certificate starts at a disadvantage against competitors that have one.
Is a free certificate enough?
For the overwhelming majority of sites, yes. A free certificate provides the same connection encryption as a paid one and renews automatically. The difference is mostly in extended organisation validation and support level, which most sites do not need.