Do I Need an SSL Certificate for My Website?
Short answer: yes. Longer answer: you almost certainly shouldn’t be paying extra for one, and if someone is trying to sell you a “premium” or “extended validation” certificate for a local business website, you’re being upsold something that no customer will ever see.
SSL is one of those bits of website jargon that sounds technical enough that most people nod along and reach for their card. It’s worth ten minutes of your time to understand what it actually is, because the gap between what it does and what people think it does is where the money gets made.
What an SSL certificate actually does
When your browser loads a page over an ordinary http:// connection, everything travels across the internet as plain readable text. Anyone sitting on the same café Wi-Fi, or on any of the networks in between, can read it. That’s fine for a page of opening hours. It is not fine for someone typing their name, phone number and description of their leaking bathroom into your contact form.
An SSL certificate — properly TLS these days, though nobody says that — scrambles that connection. Your site and the visitor’s browser agree a private code, and everything between them becomes unreadable to anyone in the middle. The address changes from http:// to https://, and the browser shows a padlock.
Here is the misconception worth correcting, because it’s the one the industry has quietly encouraged for years: the padlock does not mean the business is trustworthy, verified, or real. It means the connection is encrypted. That’s all. A scam site can get a padlock in about ninety seconds, and plenty do. Encryption tells you nobody is eavesdropping; it says nothing whatsoever about who is at the other end.
That cuts both ways. It means the padlock is not the badge of legitimacy some salespeople imply — but it also means the absence of one is now genuinely damaging, because browsers have made it impossible to ignore.
What visitors see if you haven’t got one
This is the part that costs you money. Chrome, Safari, Firefox and Edge all mark plain http:// pages as “Not secure” in the address bar. On a page with a form on it, some browsers go further and put a warning directly on the field as someone starts typing.
Picture the moment. Someone has found you, read your prices, decided you’ll do, and is halfway through typing their mobile number. The browser tells them the site is not secure. They don’t know it’s a technical statement about encryption — they read it as “this company is dodgy”. You never hear from them, and you never find out why.
That’s the real cost, and it lands hardest on exactly the businesses least likely to notice: small, local, enquiry-driven ones where every form submission matters.
There’s a search angle too. Google has treated HTTPS as a ranking signal for years. It’s a small factor next to the things that actually move the needle for a local business — reviews, relevance, and a properly filled-in Google Business Profile — but it’s a free one, and there’s no reason to give it away.
What it should cost
Almost nothing, and usually literally nothing.
The reason is Let’s Encrypt, a non-profit certificate authority that has issued basic certificates free and automatically since 2016. Every serious hosting company now plugs into it. Your host requests the certificate, installs it, and renews it every few months without anyone touching a thing. That’s the norm, not a perk.
So the honest price guide looks like this. These are typical UK figures and vary between providers, so check what’s in front of you rather than assuming:
| What you’re offered | Typical UK price | Worth it for a local business? |
|---|---|---|
| Free automated certificate via your host | £0 | Yes — this is the right answer for almost everyone |
| Paid “standard” or DV certificate | roughly £10–£60 a year | No. Identical padlock, identical encryption |
| ”Extended validation” (EV) certificate | often £100+ a year | No |
The EV one deserves a note, because it’s the pitch that still catches people out. EV certificates involve a company being vetted, and browsers used to reward that with the business name displayed in green next to the address. Chrome and Firefox removed that display back in 2019 — research had shown users simply didn’t notice it. So the thing you’d be paying for is no longer shown to anyone. The padlock a shop pays £150 a year for looks precisely the same as the free one.
If your host charges separately for SSL at all, that tells you something about the host. It’s worth reading our piece on what website hosting actually buys you before you renew.
How to check your own site in thirty seconds
- Open your website on a phone or laptop.
- Look at the address bar. Is there a padlock, or the words “Not secure”?
- Click the padlock. It should say the connection is secure.
- Now type your address deliberately as
http://yourbusiness.co.uk— without the s. A correctly configured site will silently redirect you to thehttps://version. If it loads and stays onhttp://, that redirect is missing and needs fixing. - Check a few inside pages too, not just the homepage.
Two problems show up often enough to be worth naming.
An expired certificate. Certificates have an end date. If renewal fails and nobody notices, visitors get a full-page red warning telling them your site may be an attacker — far worse than never having had one. This is the single strongest argument for automatic renewal: nobody has to remember.
Mixed content. The page itself is secure, but an image or script somewhere on it still loads over http://. The padlock disappears or shows a warning even though the certificate is perfectly fine. It’s a fiddly one to trace and a normal part of ongoing website maintenance.
What it doesn’t do
Worth being clear, because it’s oversold constantly. An SSL certificate does not make your website secure. It secures the connection to your website. It won’t stop your site being hacked through out-of-date software, won’t stop a weak password being guessed, and won’t stop spam coming through your contact form.
Nor does it discharge your data protection duties. If your form collects names, emails and phone numbers, encryption is one sensible measure among several — you still need a privacy policy explaining what you do with that information, which we cover in our guide to the legal requirements for a UK business website.
The bottom line
Yes, you need one. No, you shouldn’t pay for it separately. If you’re setting up a new site, the question isn’t “should I buy SSL?” — it’s “does this host include it and renew it automatically?” If the answer is no, choose a different host.
Here’s where we declare our interest: we host the sites we build, and a free automatically-renewing certificate is included in that, because in 2026 charging extra for one would be a bit like charging extra for the front door. If you’re a new UK business without a website yet, our free-website offer covers the build and the domain, and hosting is the only ongoing cost.
Whoever you go with, the test is the same. Padlock on every page, http:// redirecting to https://, renewal happening without you thinking about it, and nothing on the invoice for the privilege.