The padlock that appears in a browser's address bar is one of the most recognized symbols on the web. An SSL certificate is what puts it there, and what it actually does goes further than most visitors realize. It determines whether data sent through your site travels encrypted or in plain text readable to anyone intercepting the connection. Understanding how SSL works, and where it falls short, changes how you approach protecting your visitors.
SSL is the underlying technology that makes HTTPS possible. When a visitor's browser connects to a website with a valid SSL certificate, it establishes an encrypted connection before any data is exchanged. The padlock icon, the HTTPS prefix in the address bar, and the absence of a "Not secure" browser warning are all produced by that certificate being present and valid. For context on why security matters across your whole website, see the article on why website security is important.
What does an SSL certificate actually do?
An SSL certificate performs two distinct functions at the same time. It encrypts data in transit and it authenticates the website's identity.
Encryption
- Encryption means that any data sent between the browser and the server is scrambled into unreadable form during transmission
- Only the intended recipient, either the browser or the server, holds the key to unscramble it
- Without encryption, form submissions, login credentials, and payment details travel across networks as plain text that can be read if intercepted
Authentication
- An SSL certificate is issued by a certificate authority, an independent organization that verifies a website's identity before issuing the certificate
- This verification process confirms that the domain the certificate covers is controlled by the organization claiming to own it
- When a browser checks the certificate, it confirms both that the connection is encrypted and that the site is the one it claims to be, not an impersonator
How does SSL encryption work?
The encryption process happens automatically and invisibly at the moment a browser connects to a website. It involves a sequence of steps called the TLS handshake. TLS, or Transport Layer Security, is the modern name for the protocol originally called SSL.
The connection sequence
- The browser requests a secure connection and the server responds by sending its SSL certificate
- The browser verifies the certificate with the certificate authority that issued it, confirming it is valid and has not expired
- Both sides agree on an encryption method and exchange keys, establishing a secure channel
- All data transmitted after this point is encrypted for the duration of the session
What the encryption protects
- Contact form data, including names, email addresses, and messages
- Login credentials, including usernames and passwords
- Payment card details and billing information
- Any other input a visitor submits through your website
What SSL does not protect
- SSL encrypts data in transit. It does not protect data that is stored insecurely on the server after it has been received
- A website with an SSL certificate can still be hacked if the server itself has security vulnerabilities
- SSL is one layer of website security, not a complete solution on its own
What are the different types of SSL certificates?
SSL certificates vary by the level of identity verification the certificate authority performs before issuing them.
Domain validation
- The certificate authority confirms only that the applicant controls the domain
- The process is automated and certificates are issued quickly
- Domain validation certificates are sufficient for blogs, informational websites, and most websites that do not process payments directly on-site
Organization validation
- The certificate authority verifies both the domain and the legal existence of the organization applying for the certificate
- Organization validation certificates are more commonly used by businesses that want to display verified organization information alongside the certificate
Extended validation
- Extended validation certificates involve the most thorough identity verification process, including legal, physical, and operational checks on the organization
- They were historically associated with a green address bar in browsers, though this visual distinction has been removed in modern browsers
- Extended validation certificates are typically used by financial institutions and large e-commerce platforms
Wildcard and multi-domain certificates
- A wildcard certificate covers a domain and all of its subdomains under a single certificate
- A multi-domain certificate covers multiple separate domains under one certificate
- These are practical for organizations managing multiple sites or subdomains without issuing a separate certificate for each
Do all websites need an SSL certificate?
Yes. The need for HTTPS is not limited to websites that take payments or handle sensitive data. It applies to every publicly accessible website for three reasons.
Browser warnings
- Browsers display a "Not secure" label in the address bar for any website served over HTTP
- For pages with forms, some browsers show an explicit warning before a visitor submits anything
- These warnings reduce trust and discourage visitors from interacting with the page
Search ranking
- HTTPS is a confirmed ranking signal. Sites served over HTTPS have a ranking advantage over equivalent pages served over HTTP
- Search engines also reduce the visibility of sites with active security warnings in results
Visitor data protection
- Even a website that only has a contact form is collecting visitor data. Without HTTPS, that data is transmitted without encryption
- In many regions, data protection regulations require that personal data be handled securely, which includes protecting it during transmission
How do you get an SSL certificate?
Through your hosting provider
- Many website hosting providers include SSL certificates as part of their hosting packages
- In these cases, the certificate is installed and renewed automatically without any action from the site owner
- This is the simplest option for most websites
Through a certificate authority
- SSL certificates can be obtained directly from certificate authorities and installed on a server manually
- Free certificates are available from widely trusted certificate authorities and are renewed automatically using verification tools
- This option requires more technical knowledge and is more common for development teams managing their own servers
After obtaining the certificate
- Once a certificate is installed, all internal links and asset references on the site should point to HTTPS URLs to avoid mixed content warnings
- A redirect from HTTP to HTTPS should be configured so that visitors who reach the HTTP version are automatically sent to the secure version
For a complete explanation of what HTTPS means and how it affects your visitors and rankings, see the article on what HTTPS is and how it protects your website. For a full guide on protecting your website beyond the certificate itself, see the article on how to protect your website from hackers. For guidance on website backups as a complementary security measure, see the article on how to back up your website.
How WEMASY handles SSL certificates
SSL certificates are included on every WEMASY plan. When a website is created on the WEMASY platform, the certificate is installed and activated automatically. All pages are served over HTTPS by default without any setup required from the site owner.
Certificates are renewed automatically before they expire. There is no manual renewal process and no risk of the certificate lapsing and triggering browser warnings. The underlying SSL infrastructure is maintained at the platform level, so site owners do not need to manage it directly.
See what is included at the WEMASY website builder, or review plan options on the pricing page.
Frequently asked questions
What is an SSL certificate?
An SSL certificate is a digital file installed on a web server that enables encrypted connections between the server and visitors' browsers. It is what allows a website to use HTTPS rather than HTTP. When a visitor's browser verifies a valid SSL certificate, it establishes an encrypted channel so that data transmitted during the session cannot be read if intercepted in transit. With WEMASY's website builder, you can set this up directly on your website.
Do I need an SSL certificate for my website?
Yes. Every publicly accessible website needs an SSL certificate. Browsers display a "Not secure" warning on sites without one, and HTTPS is a confirmed ranking signal for search engines. Even a website that only collects contact form submissions is transmitting visitor data that should be protected during transit. The type of SSL certificate required depends on the site's purpose, but some form of certificate is necessary for all websites.
What is the difference between SSL and TLS?
TLS (Transport Layer Security) is the modern, updated version of the SSL (Secure Sockets Layer) protocol. SSL has not been actively used for over two decades, but the term is still widely used informally to refer to the technology that secures web connections. When someone says "SSL certificate," they are almost always referring to a certificate that uses TLS. The underlying protocol handling the encryption has been updated, but the certificates themselves have not changed significantly in how they are used.
What happens if my SSL certificate expires?
When an SSL certificate expires, browsers immediately display a full-page warning to visitors attempting to access the site. The warning states that the connection is not private and discourages visitors from proceeding. The site effectively becomes inaccessible to anyone who sees the warning and does not choose to bypass it. Search engines may also reduce the site's visibility. Certificates should be renewed before they expire, which most hosting providers and certificate management systems handle automatically.
Does an SSL certificate affect website performance?
The TLS handshake that establishes an encrypted connection adds a small amount of time to the initial connection. On modern servers and networks, this overhead is typically measured in milliseconds and is not noticeable to visitors. HTTP/2, which is widely supported and requires HTTPS, can improve loading performance compared to HTTP/1.1, so in practice a well-configured HTTPS site often loads faster than its HTTP equivalent.
Is a free SSL certificate as good as a paid one?
For encryption purposes, a free domain validation certificate provides the same level of encryption as a paid certificate at the same validation level. The padlock icon and HTTPS prefix appear identically in the browser. Paid certificates at the organization validation or extended validation level offer additional identity verification, which may be relevant for financial institutions or large e-commerce platforms where verified organization information is important. For most websites, a free certificate is fully sufficient.