HTTPS encrypts the connection between a visitor and your website. In 2026 a site left on plain HTTP is flagged before anyone reads it. This is what a certificate does, what the browser actually shows, and how to turn it on without breaking the page.
What SSL actually does
People still say SSL. The protocol in use is TLS. It scrambles data between the browser and the server so passwords, form entries and payment details are not readable in transit. The address changes from http:// to https://. Encrypts HTTPS traffic and enables secure browser connections. Leave it off and Chrome and other browsers label the page "Not secure".
What the browser does not show
Modern browsers no longer use a lock icon as proof that a site is safe, and they do not give extended-validation certificates a special address-bar treatment. Extended Validation confirms organization identity with the certificate authority. It does not make the encryption stronger than a domain-validated certificate. Tell visitors to check that the address starts with https:// and that the browser is not showing a warning.
Why it is still required
- Browser warnings. Plain HTTP is marked "Not secure". That warning is enough for many people to leave a checkout.
- Search. Google has treated HTTPS as a lightweight ranking signal for years. It will not rescue a thin page, and skipping it is an avoidable disadvantage.
- Forms and payments. Anything that collects personal or payment data should be encrypted in transit. Payment providers expect it.
Free DV versus a paid certificate
A free domain-validated certificate encrypts the connection. That is what a blog, a portfolio or a normal business site needs. Organisation-validated and extended-validation certificates add checks on the organisation's identity. They are a verification product, not a faster or stronger lock. Request a quote on the SSL page if you need that check. Confirm the price before anyone pays.
HTTPS is more than installing a file
After the certificate is active, every image, script and stylesheet must load over https:// as well. One leftover http:// link causes a mixed-content warning. Also redirect http:// to https:// so old links land on the secure address. Check the result with the SSL checker.
On PK Hosting shared and WordPress plans, a free DV certificate is included. Issue it after the domain resolves to the server — Let's Encrypt has to reach the site. The steps are in install your free SSL certificate. If the first attempt fails, the usual cause is DNS that still points somewhere else.
Discussion
0 comments