Every website should have an SSL certificate (technically TLS, though "SSL" is still the common name). It's not optional in any practical sense anymore, and it's worth understanding exactly what it does, since the padlock icon it produces gets over-read by a lot of visitors and business owners alike.
What it actually does
An SSL certificate encrypts the connection between a visitor's browser and the website's server. Anything typed into a form, any page requested, travels encrypted instead of as plain, readable text. That matters directly any time a visitor submits information, even something as simple as a name and phone number on a contact form.
What it doesn't do
It doesn't mean the business is legitimate, doesn't mean the content is accurate, and doesn't protect against every kind of attack. A scam website can have a valid SSL certificate. It only guarantees the connection itself is private, not anything about who's on the other end of it.
Why browsers make a big deal of its absence
Modern browsers actively flag a site without SSL as "Not Secure" directly in the address bar, visible to every visitor before they've read a word of content. That warning alone is enough to make some visitors leave immediately, regardless of how trustworthy the business actually is.
It also affects search ranking
Google has confirmed HTTPS (the result of having a valid SSL certificate) as a ranking signal, though a minor one compared to content quality and relevance. It's a small, essentially free improvement with no real downside to having.
Getting one is no longer difficult or expensive
Most modern hosting includes a free SSL certificate automatically, often through Let's Encrypt, a nonprofit certificate authority that issues and renews them at no cost. If a site doesn't have one in 2026, it's almost always a hosting oversight rather than a real cost barrier.
Questions
Do I need to do anything to keep it working?
Certificates expire and need periodic renewal, but most modern hosts and platforms handle this automatically. It's worth confirming with your host that renewal is automatic rather than assuming.
Does SSL protect my site from being hacked?
No. It protects data in transit between visitor and server. Site security against hacking is a separate concern involving software updates, strong credentials, and hosting security. See software updates: why a static site skips a whole category of risk.
Is there any reason not to have SSL?
No. There's no legitimate reason for a modern website to run without it, given that it's free and standard on virtually all hosting today.