What Is an SSL Certificate and Does My Website Need One?
Learn what an SSL certificate does, why HTTPS matters, and how renewal, redirects and mixed content affect a business website.
Part of our guide: Who Owns Your Business Website? Domains, Content, Hosting and Access Explained
A business website should use HTTPS, which protects information travelling between a visitor’s browser and the server and helps authenticate the connection to the domain.
People often call the required certificate an SSL certificate, although modern secure connections use TLS. The familiar term remains common in hosting packages.
A secure connection is important, but it does not prove that the business itself is honest or that every part of its website is secure.
What does the certificate establish?
A browser uses the certificate and the TLS process to check the server’s identity for the domain and establish an encrypted connection.
This helps protect information in transit from interception or alteration. It matters for contact forms, sign-ins and ordinary browsing too.
It does not automatically protect data after it reaches the server, prevent malicious code on the site or verify every commercial claim.
Thinking about your own rebuild?
Tell us about your business, your current website and what you would like to improve. We will help you work out the next step.
Does a brochure website need HTTPS?
Yes. Visitors should be able to read pages and submit enquiries over a protected connection, even when the website does not take payments.
A brochure site may still collect names, contact details or messages. It can also rely on browser features that expect a secure context.
Do not wait until a payment system is added before treating secure delivery as part of normal hosting.
How are certificates issued?
Certificate authorities validate control of the relevant domain under their procedures. Hosting providers often automate issuance and renewal.
Let’s Encrypt explains its automated process, including domain validation and certificate issuance. It is one example of how certificates can be managed without a manual purchase for every renewal.
Check what your host provides and who is responsible when validation or renewal fails.
Free and paid certificates
The price alone does not tell you whether encryption is effective. Different products may include different validation, support or contractual features.
Choose according to the actual hosting and organisational requirements. Do not assume a small business needs an expensive certificate merely because it accepts enquiries.
Ask the supplier to explain the practical benefit of any additional charge and whether management is included.
Renewal must be monitored
An expired certificate can produce browser warnings and prevent visitors from using the site confidently.
Automatic renewal still depends on working configuration, domain validation and provider systems. Someone should monitor failures and know how to recover.
Include certificates in the hosting responsibility agreement rather than assuming the original developer will always notice.
Check the whole page
A page can use HTTPS while still referring to insecure resources. Mixed-content problems may block scripts, images or other functions.
Check that internal links, forms and assets use the intended secure URLs. Redirect the ordinary HTTP version appropriately and keep the preferred domain version consistent.
Test after a hosting move, especially when DNS or certificate validation methods change.
Do not ignore browser warnings
Use the Not Secure warning checklist to separate connection failures from other alerts. If HTTPS loads but a resource fails, investigate mixed content.
Investigate the cause through the hosting or technical support team. It could be expiry, a domain mismatch, an incomplete certificate chain or another configuration problem.
Do not ask customers to bypass warnings as a routine solution. Restore the expected secure connection and verify the affected routes.
Keep a clear support contact and recovery process for incidents.
What changes during migration?
The new host needs a valid certificate for the intended domain before or during the planned traffic switch. The approach depends on the provider and DNS arrangement.
Coordinate validation, redirects and testing. Read the DNS guide and moving to another agency before treating the certificate as an isolated task.
What should an owner ask?
Ask whether HTTPS is enabled across the site, who manages renewal, how failures are detected and what support is included.
Also ask how forms and stored information are protected beyond transport encryption. Those are separate responsibilities.
The wider website ownership guide helps document them. Contact AfterWorks if you need a practical review of secure delivery and hosting continuity.
