What Is an SSL Certificate?

An SSL certificate is what makes the connection between a visitor and your server private. Without one, everything sent between the two travels as plain text, and every machine along the route can read it. That includes card numbers, login details and anything else typed into a form.

With a certificate installed, the same data is encrypted in transit. Someone intercepting it sees noise rather than content, and only the browser and the server can make sense of it. The padlock in the address bar is the browser telling the visitor that this is the case.

A note on the name: the protocol in use today is TLS, and has been for years. "SSL certificate" stuck as the everyday term, and hosting providers still sell it under that name, so both are used to mean the same thing.

Where it matters most

Every site should have one, and the stakes vary with what the site does.

Take a site whose only function is a blog. Visitors read and leave, and they never submit anything. The direct risk to them is small, and the certificate is still worth having, because browsers and search engines now treat encryption as the default rather than as a feature.

Now take an online shop. Customers enter names, addresses, phone numbers and payment details, and every one of those fields is a place where interception has a real consequence. Nobody should buy from a shop without HTTPS, and most shoppers now know enough to check.

The same applies to any site with a login, a contact form, a booking flow or a newsletter signup. If a visitor types something, the connection needs to be encrypted.

What happens without one

Two audiences notice a missing certificate, and both of them cost you money. This is the part that makes encryption a SEO topic rather than only an IT one.

Search visibility suffers. HTTPS has been a confirmed, if lightweight, ranking signal for over a decade. It rarely decides a competitive query on its own, and it functions as a tiebreaker and as part of the broader page experience assessment. More practically, an unencrypted site fails almost every technical audit and blocks several other things you would want: HTTP/2 and HTTP/3 both require HTTPS, and those protocols are part of how you get Core Web Vitals into acceptable territory.

Browsers warn your visitors. Chrome, Safari, Edge and Firefox all mark unencrypted pages as "Not secure" in the address bar, and they show a full-page interstitial warning when a form is involved.

That warning does more damage than the ranking signal ever will. A visitor who arrives from search, sees a security warning and leaves has cost you the click and the impression of a business worth buying from.

Getting HTTPS set up properly

Two things have to line up: your hosting has to support and serve the certificate, and the site has to be built to use it. Most hosting providers now issue certificates automatically, and Let's Encrypt made them free and renewable by script, so the barrier is no longer cost.

What actually goes wrong is the migration from HTTP to HTTPS. The checklist worth working through:

• Redirect every HTTP URL to its HTTPS equivalent with a 301, one hop, no chains. An http to https to www chain is a common finding and it wastes crawl budget on every page. The wider topic is covered under site health and redirects.
• Fix mixed content. A page served over HTTPS that loads an image, script or stylesheet over HTTP is flagged as insecure, and the browser may block the resource outright. Search your templates and your database for hardcoded http:// references.
• Update canonical tags, hreflang, sitemaps and internal links to the HTTPS versions. Internal links pointing at the old protocol send every visitor through a redirect they did not need.
• Add the HTTPS property in Search Console. It is a separate property, and forgetting it makes it look like your traffic collapsed on migration day.
• Enable HSTS once you are confident everything resolves over HTTPS. It tells browsers never to attempt the unencrypted version, which removes the redirect entirely.
• Monitor expiry. Certificates expire, and an expired certificate produces a full browser block rather than a warning. Automated renewal plus an alert is a ten-minute job that prevents a very bad afternoon.

Handled properly, moving to HTTPS should cost you nothing in rankings. Handled as a checkbox, it produces redirect chains, mixed content warnings and duplicate URL sets that a technical audit then has to unpick.

Where it sits in the bigger picture

Encryption is one of the cheapest items on any technical SEO list, and it belongs in the same category as a clean sitemap and a working robots.txt: not a competitive advantage, and the absence of it is a real disadvantage. Trust signals also feed into how both search engines and language models assess a source, which connects it to E-E-A-T more directly than it might first appear. A site that browsers flag as unsafe is not a site anyone wants to cite.

If you want to know what else is sitting in your technical foundation, that is part of what a free SEO analysis looks at.