An SSL certificate (technically a TLS certificate today) proves a website’s identity and encrypts the connection between the site and its visitors, which is what turns http:// into https:// and shows the padlock in the browser. To enable an SSL certificate, turn on the free certificate your web host or website builder provides (usually from Let’s Encrypt), force all traffic to HTTPS with a 301 redirect, and fix any “mixed content” that still loads over HTTP. Most sites can do this in minutes at no cost, and hosts and builders renew the certificate automatically.
This guide explains what an SSL certificate is, why it matters in 2026, the types available and step-by-step instructions for enabling one on the most common platforms.
Updated October 2026.
Go to:
What is an SSL certificate?
An SSL certificate is a small data file, issued by a trusted certificate authority (CA), that links a domain name to a cryptographic key. When someone visits your site, their browser checks the certificate to confirm it is talking to the real website and then uses it to set up an encrypted connection.
SSL stands for Secure Sockets Layer, the original protocol from the 1990s. It has been replaced by TLS (Transport Layer Security), and all versions of SSL are now deprecated as insecure. The name “SSL certificate” stuck, so you will see both terms used for the same thing. Modern sites use TLS 1.2 or TLS 1.3, while TLS 1.0 and 1.1 were formally deprecated by the IETF.
HTTP vs. HTTPS
HTTP sends data in plain text, so anyone on the same network, such as public Wi-Fi, could read or change it. HTTPS is HTTP over an encrypted TLS connection. With HTTPS, login details, payment information and form submissions are protected in transit, and the browser shows a padlock or similar indicator.
Why do you need an SSL certificate in 2026?
HTTPS is now the default expectation on the web, not an optional extra:
- Browser warnings: Chrome and other browsers label HTTP pages as “Not secure”. Google announced that Chrome 154, released in October 2026, turns on “Always Use Secure Connections” by default, which warns users before loading public sites over HTTP.
- Trust and conversions: visitors are less likely to enter details or buy on a page flagged as not secure.
- Data protection: encryption protects your visitors’ data and your admin logins from interception.
- SEO: Google has used HTTPS as a lightweight ranking signal since 2014, and it is part of Google’s page experience guidance.
- Modern features: many browser features, such as geolocation, service workers and HTTP/2 or HTTP/3 in browsers, require HTTPS.
What types of SSL certificates are there?
SSL certificates differ in how thoroughly the certificate authority checks who you are and how many domains they cover.
By validation level
| Type | What the CA verifies | Typical cost | Best for |
|---|---|---|---|
| Domain Validated (DV) | That you control the domain | Free (Let’s Encrypt) or low cost | Blogs, small business sites, most websites |
| Organization Validated (OV) | Domain control plus the organization’s legal identity | Paid | Companies that want verified details in the certificate |
| Extended Validation (EV) | A stricter check of the organization’s identity | Paid, highest cost | Some banks and large enterprises |
All three provide the same encryption strength. Browsers no longer show a special green bar or company name for EV certificates in the address bar, so for most websites a free DV certificate is enough.
By domain coverage
- Single-domain: covers one name, such as www.example.com (and usually example.com).
- Wildcard: covers a domain and all its first-level subdomains, such as *.example.com.
- Multi-domain (SAN): covers several different names in one certificate, such as example.com, example.net and shop.example.org.
How long is an SSL certificate valid?
Certificate lifetimes are getting shorter. Under a CA/Browser Forum rule adopted in 2025, the maximum validity of publicly trusted TLS certificates falls in stages: 200 days for certificates issued from March 15, 2026, then 100 days from March 2027 and 47 days from March 2029.
Let’s Encrypt certificates are already short-lived at 90 days. Let’s Encrypt began offering 45-day certificates as an opt-in in May 2026, plans to move its default to 64 days in February 2027 and to 45 days in February 2028. Shorter lifetimes make automatic renewal essential. If your host or builder manages your certificate, renewal is handled for you.
How do you enable an SSL certificate?
The steps depend on where your site is hosted. Start with the option that matches your setup.
On a website builder (Wix, Squarespace, Shopify)
Hosted website builders issue and renew SSL certificates automatically for domains connected to your site. Check that SSL or HTTPS is turned on in your site’s domain or security settings, and that your domain’s DNS points correctly to the builder. If the certificate shows as pending, it usually means the DNS records have not finished updating.
On shared or managed web hosting
Most hosts, including Hostinger and Bluehost, include a free SSL certificate with their plans.
- Log in to your hosting dashboard (hPanel, cPanel or your host’s custom panel).
- Open the SSL or Security section. In cPanel, look for SSL/TLS Status or AutoSSL.
- Select your domain and click to install or activate the free certificate.
- Wait for issuance, which usually takes a few minutes once DNS points to the host.
- Turn on the host’s “Force HTTPS” option if available.
On WordPress
- Enable the certificate at your host as described above.
- In Settings > General, change both the WordPress Address and Site Address to start with https://.
- Redirect all HTTP traffic to HTTPS with a 301 redirect, using your host’s setting, your server configuration or a reputable SSL plugin.
- Update hard-coded http:// links in your content, theme and menus. A search-and-replace tool or plugin can do this in bulk. Back up your database first.
On your own server (VPS or dedicated)
If you manage your own server, use an ACME client such as Certbot to request a free Let’s Encrypt certificate and configure automatic renewal. For a paid OV or EV certificate, generate a certificate signing request (CSR) on the server, submit it to the certificate authority, complete validation, then install the certificate and intermediate chain in your web server (Apache, Nginx or similar).
Through a CDN or proxy
Services like Cloudflare can provide a certificate at the edge. Use a “full (strict)” style setting so traffic is also encrypted between the CDN and your server, not just between visitors and the CDN.
What should you do after enabling SSL?
Turning on the certificate is only half the job. Complete these steps so every visitor gets a secure connection:
- Force HTTPS everywhere with permanent 301 redirects from HTTP to HTTPS.
- Fix mixed content. Images, scripts or stylesheets loaded over http:// can break the padlock. Use your browser’s developer tools to find them.
- Update links in your sitemap, canonical tags, social profiles and ads to the https:// version.
- Check Google Search Console. A Domain property covers both HTTP and HTTPS. If you use URL-prefix properties, add the https:// version.
- Consider HSTS, a header that tells browsers to always use HTTPS for your domain. Enable it only after you are sure everything works over HTTPS.
- Monitor renewals. With shorter certificate lifetimes, confirm that automatic renewal is working.
How can you tell if a site has SSL?
Look at the address bar. A site with a valid certificate starts with https://, and most browsers show a padlock or a “tune” settings icon. Click it to see the certificate details, including the issuer, the domain names covered and the expiry date. If the certificate is expired, invalid or does not match the domain, the browser shows a full-page warning instead.
How does an SSL/TLS connection work?
When a browser connects to an HTTPS site, it performs a TLS handshake:
- The browser says hello and lists the encryption methods it supports.
- The server responds with its certificate and chosen settings.
- The browser checks that the certificate is valid, unexpired, issued by a trusted CA and matches the domain.
- The two sides use public-key cryptography to agree on shared session keys.
- All further data is encrypted with those fast symmetric keys.
TLS 1.3 completes the handshake in a single round trip, so the performance cost of HTTPS on modern servers is minimal.
If you are setting up a new site, check that your name is available as a domain with Namechk, and see our guides to what a domain name is and website costs for the rest of your budget.
FAQs
Is an SSL certificate free?
Yes, for most websites. Let’s Encrypt, a nonprofit certificate authority, issues free domain-validated SSL certificates, and almost every web host and website builder uses it or a similar service to include SSL at no extra cost. Paid certificates are mainly needed for organization or extended validation, or for specific warranty and support requirements. The encryption strength is the same.
How do I know when my SSL certificate expires?
Click the padlock or site settings icon in your browser’s address bar and view the certificate details to see its expiry date. Hosting dashboards also show certificate status. Because maximum certificate lifetimes are shrinking, to 200 days from March 2026 and eventually 47 days in 2029, rely on automatic renewal and monitoring rather than manual reminders.
Does SSL help with SEO?
Yes, slightly. Google has used HTTPS as a lightweight ranking signal since 2014, and secure connections are part of its page experience guidance. The bigger benefit is indirect: browsers label HTTP pages as not secure, and Chrome 154 turns on HTTPS-first browsing by default, so an HTTPS site avoids warnings that would drive visitors away.
What is the difference between SSL and TLS?
TLS (Transport Layer Security) is the modern successor to SSL (Secure Sockets Layer). All SSL versions are deprecated because of security flaws, and today’s secure websites use TLS 1.2 or TLS 1.3. The certificates are the same, and the industry still commonly calls them SSL certificates, so SSL certificate and TLS certificate mean the same thing in practice.
Why does my site still say not secure after installing SSL?
Usually because some content still loads over HTTP, called mixed content, or because the site is not redirecting HTTP to HTTPS. Update your site URL to https://, add a 301 redirect for all HTTP requests and replace http:// links to images, scripts and stylesheets. Also check that the certificate covers both the www and non-www versions of your domain.
Is there SSL for email?
Yes. Email servers use TLS to encrypt messages in transit between servers and between your email app and the server, using STARTTLS or implicit TLS on dedicated ports. Gmail requires senders to use TLS. This protects mail in transit but does not encrypt messages stored in inboxes. For end-to-end protection, use S/MIME or PGP encryption.
CHK_ YOUR NAME RIGHT NOW
Use our engine to quickly check your content right now!
