Do You Need an SSL Certificate? What Actually Happens Without One

Yes, for any site that does business. If your site takes a form submission, an email address, a booking or a payment, an SSL certificate is not optional, and even for a site that collects nothing, the practical answer is still yes: browsers have marked plain HTTP sites as "not secure" in the address bar since 2018, and visitors notice that warning before they read a word of your content.

If you host with us, you already have one, and it renews itself. The interesting question is not whether you need a certificate, it is which kind, and for most small businesses the free one is genuinely sufficient.

What actually happens without a certificate

Concrete effects, in the order a visitor encounters them.

1. The address bar shows "Not secure". Chrome began flagging all HTTP pages as not secure in 2018, and the

same treatment now appears in other major browsers. This is not a subtle icon. It appears next to your business name.

1. Forms get abandoned. A visitor who sees a warning on the page where they were about to enter their email

address or card details usually leaves instead. The conversion cost of that warning is real and measurable in your own enquiry numbers.

1. Search visibility can suffer, indirectly. HTTPS has been treated as a positive signal for years, and more

importantly, sites that trigger browser warnings earn fewer clicks and fewer links, which is what actually affects rankings over time.

1. Payments and integrations stop working. Payment gateways, booking systems and many APIs require HTTPS

endpoints, so a site without a certificate cannot integrate with them at all.

1. Compliance becomes an issue. Any process that involves card data has an encryption requirement. Even if

you never store a card number yourself, the form that collects it needs to be encrypted.

Where the free certificate lands you

Every Web Hosting People plan includes an AutoSSL certificate. It issues automatically once your domain points at the hosting, renews itself, and gives you:

• full encryption between the visitor's browser and the server
• the padlock, and no "not secure" warning
• HTTPS on the domain it is issued for

What it does not do:

• prove that your business exists (that is organisation validation)
• cover multiple subdomains on one certificate (that is a wildcard certificate)
• carry a warranty against certificate failure

For a brochure site, a service business site or a blog, those three limitations rarely matter. The encryption is the same either way. Where they matter is described below, and it is a short list.

When the free certificate is not enough

A customer, platform or tender asks for verification. Marketplaces, payment providers, enterprise procurement and some integrators ask for an organisation validated certificate, because they want proof the business behind the domain is real.

You run multiple subdomains. shop., portal., book. and www. each need their own certificate unless you hold a wildcard. A wildcard covers every subdomain on one domain with a single certificate.

A contract requires a warranty. Higher tiers carry warranties against certificate failure, from USD $10,000 to USD $1,750,000 depending on the tier. If a contract specifies one, that is a requirement rather than a preference.

A named brand is specified. Occasionally a platform will name the certificate authority it accepts. Match the requirement rather than paying for the most expensive option.

If none of those apply, the free certificate is the correct answer, and we would rather tell you that than sell you a certificate you do not need. The paid tiers, with current pricing, are on the SSL certificates page.

All prices shown exclude GST. Prices are in AUD. Warranty figures quoted above are in USD.

Mixed content, the problem that survives having a certificate

Installing a certificate is not always the end of the story. If any part of your page still loads over plain HTTP, usually an image, a font or a script pulled from an old address, the browser treats the page as insecure and shows a warning anyway. This is called mixed content, and it is the most common reason someone says "I have a certificate but the padlock is missing a piece".

The fix is to find the offending asset and change its address to HTTPS. Your browser's developer console will list mixed content warnings by name, which makes it a ten minute job rather than a mystery.

It is also worth forcing every visitor onto the secure version rather than leaving it optional, so nobody reaches the insecure address from an old link or a bookmark. Our guide to SSL certificates and the padlock covers how to confirm the certificate is working, what to do if the warning persists just after setup, and how to redirect visitors to the secure address.

Frequently asked questions

Is a free SSL certificate as secure as a paid one? The encryption is equivalent. What differs is validation: a paid certificate can verify your organisation, cover subdomains or carry a warranty.

Will a certificate make my site rank higher? It is a positive signal and it removes a barrier to clicks, but the bigger effect is behavioural: sites with browser warnings get fewer visitors, fewer enquiries and fewer links. Treat it as a baseline requirement rather than a ranking tactic.

Do I need SSL if I do not take payments? If you collect any information at all, yes. And even if you do not, the browser warning applies to every HTTP page.

My site shows a warning but I have a certificate. Why? Usually mixed content, meaning something on the page still loads over HTTP. Occasionally it is a certificate issued for the wrong hostname, for example for www when the site is visited without it.

What happens when a certificate expires? Visitors get a full page warning before they reach your site. If your hosting is with us the free certificate renews automatically, so there is nothing to diarise. On a paid certificate, renewal follows the term you chose.

Can I install a certificate bought elsewhere? Yes. Certificates are not tied to a particular host or registrar.

Get HTTPS in place

If you host with us, the certificate is already included and renews itself. If you need organisation validation, a wildcard for subdomains or a warranty, the tiers and their prices are published.

Primary action: See the hosting plans that include free SSL