Free SSL Certificates Explained: What They Are and Why You Need One

What it actually does

Three things, and only three:

1. Encryption. Data between the visitor and your server is scrambled. On public Wi-Fi, this is the difference between your customer sending you their card details and someone on the same café network reading them.
2. Authentication. The certificate proves the site is genuinely who it claims to be, which prevents someone impersonating your site to intercept logins.
3. Integrity. Nobody can silently alter the page in transit — which is how an attacker can otherwise inject something malicious into a page you thought you were serving.

What it does not do is prove your business is legitimate, prove the site's content is trustworthy, or make the site secure in any broader sense. The padlock means "encrypted connection," not "trust this company." That distinction matters, and the padlock has been more or less meaningless as a trust signal for years.

Why free is now the right answer

Let's Encrypt launched in 2015 and changed this permanently. Its certificates are:

• Free, permanently — not a trial, not free for 90 days;
• Automatically renewable — typically every 90 days, with no action from you;
• Domain Validation only — it proves you control the domain, which is what most sites need;
• Trusted by every major browser — genuinely, not as a marketing claim;
• Technically equivalent to paid certificates for a normal website.

Extended Validation certificates — the ones with the company name in the browser bar — cost £50–£300 a year. In modern browsers, the visible difference is essentially nil. Phishing sites can get EV certificates too, so the badge doesn't indicate trustworthiness. Paying for EV on a small business site is close to pure marketing spend.

What free certificates don't cover

Legitimately, free is the wrong choice when:

• you sell to other businesses over the API — needs a code-signing certificate, which is a different thing entirely;
• you run a web application you distribute — likewise code signing;
• you handle very high-value transactions and want to evidence a higher standard — arguable, and rare for small businesses;
• you need wildcard coverage across many subdomains — free wildcards are available but renewal can be awkward; paid is often simpler at scale.

For a brochure site, a WordPress site, or a small e-commerce shop taking card payments: free, auto-renewing, wildcard where useful. Done.

Getting it right

Most SSL problems come from a handful of predictable mistakes:

• Certificate present but not auto-renewing. If renewal fails, the site silently becomes insecure. This is the main reason free certificates can look unreliable — the setup was wrong, not the certificate.
• Forgetting www or the bare domain. They're separate names. Customers will type both.
• Leaving HTTP pages unredirected. A certificate on a page nobody visits changes nothing. Every link, image and script must point to HTTPS.
• Mixed content. One image loaded over HTTP breaks the padlock. The console tells you exactly which.
• Not redirecting at the server level. You want http:// to 301-redirect permanently to https://, so Google knows to index the secure version.
• Auto-renewal needs an email address that still works. This is quietly the number-one cause of expiring certificates on managed hosts.

Does it affect SEO?

Yes, modestly and consistently. Google has confirmed that HTTPS is a ranking signal, and Chrome has labelled plain HTTP sites "Not Secure" since 2016. For a local business competing against sites that have HTTPS, not having it is a quiet handicap — and if a customer is choosing between you and a competitor, a full-screen warning is decisive at exactly the moment it matters.

Bottom line

Use a free, automatically renewed certificate covering both the bare domain and www. Redirect everything to HTTPS. Make sure mixed content is clear. It costs nothing, it takes minutes on any decent host, and "Not Secure" in a browser is one of the few unambiguously avoidable ways to lose a customer's trust.

If your host charges for SSL, ask why. On shared UK hosting in 2026, there isn't a good reason.