Why Your Site Needs SSL
You've seen the little padlock at the left end of your browser's address bar. That's an SSL certificate doing its job.
SSL — Secure Sockets Layer — scrambles the connection between your website and the person visiting it, so anything traveling between them can't be read along the way. Technically the modern version is called TLS, but everyone still says SSL, including me, and nobody's going to correct you.
Twenty years ago this was a banking thing. Today it's a requirement for every site on the internet, including a five-page site for a small business that doesn't sell anything online.
What happens if you don't have it
Browsers warn people away from you. This is the big one. Chrome, Edge, Firefox, and Safari all display a "Not Secure" notice on sites without SSL. Some show a full interstitial warning page before the site loads at all. Your visitor doesn't know what it means technically — they just know a warning appeared, and warnings mean go somewhere else.
That's the digital version of a hand-lettered sign on your front door reading Enter At Your Own Risk.
Your contact form isn't private. Even with nothing for sale, your site almost certainly has a form. Without SSL, everything typed into it — names, phone numbers, email addresses, whatever somebody explains about their problem — crosses the internet as plain readable text.
Google notices. Google has said outright that HTTPS is a ranking signal. Between two otherwise comparable sites, the secure one has the edge. When you're competing for "plumber near me" against six other local shops, you don't want to hand one of them a free advantage.
It looks unprofessional to the people who do know. Not every customer checks. But some do, and they're often the ones writing bigger checks.
About the "SSL tax"
Here's where I get a little pointed.
Plenty of hosting companies still sell SSL certificates as a paid add-on — $70, $100, sometimes more, every year. They'll put it on the checkout page next to the hosting plan, worded to make it sound like premium protection.
It isn't. Browser-trusted certificates have been available at no cost for years now, through an initiative built specifically so basic encryption would stop being a luxury item. Millions of sites run on them. They are exactly as trusted by browsers as the ones being sold for a hundred dollars.
What those companies are really charging for is the setup — and then usually not doing the setup.
SSL is included in every plan I offer. Not as a promotion, not as an upsell, not as a checkbox you have to remember to tick. It's part of a working website, the same way a lock is part of a front door.
The part that actually takes work
If free certificates are free, why does anybody pay?
Because installing one isn't the whole job. Certificates expire — the free ones every 90 days — so renewal has to be automatic and it has to be watched, since automatic renewal quietly failing is a real thing that happens. Then the whole site has to be checked for mixed content: a single image or script still loading over the old insecure address will break the padlock on that page even though the certificate itself is perfectly fine. And requests to the old http:// address need to redirect to the secure one, or you end up with two versions of your site, which confuses Google.
That's the work. It's not hard if you do it regularly. It's genuinely annoying if you don't, and it's completely invisible until it breaks.
I handle all of it, and I check on it rather than assuming it worked.
Questions I get
Does it cover both www and the plain domain?
Yes. Both versions are covered, and one redirects to the other so you're not running two sites by accident.
What about a subdomain?
Covered too — something like shop.yourbusiness.com gets its own coverage under the same setup.
My domain is registered somewhere else. Does that matter? No. As long as your site is hosted with me and the domain points here, I can issue and manage the certificate regardless of who you bought the name from.
Is there ever a reason to pay for one? For an ordinary small business, no — and I'd rather tell you that than sell you something. The paid certificates exist for organizations with specific compliance requirements, or ones wanting Extended Validation, where the legal company name appears in the certificate details. If you genuinely need one, I'll say so and help you get it. Most people never will.
The short version
If your site shows "Not Secure," you're losing visitors before they read a word, and you're giving up ground on Google for no reason. If somebody's charging you a yearly fee to prevent that, you're paying for something that should have come with the room.