What it does
When a site has a certificate, the connection between the visitor's browser and the server is encrypted, so nobody on the same coffee-shop network or at an internet provider can read or alter the pages, passwords or form submissions in transit. The certificate also proves the site is really served by the domain it claims. Visitors see https:// and a padlock; without it, Chrome and Safari show a warning.
Why it is not optional
- Trust. A 'Not secure' label next to your business name costs you the visitor.
- Search. Google has used HTTPS as a ranking signal since 2014 and Chrome has flagged HTTP pages since 2018.
- Forms and privacy. Any contact form, login or payment on an HTTP page exposes the data. Payment processors will not run on HTTP at all.
- Modern features. Some browser features (location, service workers for speed, HTTP/2) only work over HTTPS.
What it costs and how to get one
For almost every business site, nothing. Managed hosts, Shopify, Squarespace, Wix, Cloudflare and most modern hosting include a free certificate that renews itself. Let's Encrypt provides free certificates to anyone. Paid certificates ($50 to $300 a year) still exist and are sometimes sold hard; the encryption is the same, and the 'extended validation' they offer no longer shows anything special in browsers. Pay only if a specific compliance requirement says to.
Once the certificate is in place, the site should redirect every http:// address to https:// and every page should load its images and scripts over HTTPS too, or the padlock disappears ('mixed content'). A developer checks this at launch; it is also part of a website audit.