Websites for UK businesses, explained
Does My Business Website Need an SSL Certificate?
7 November 2026
Does my business website need an SSL certificate? Yes, your business website needs an SSL certificate, so that every page loads over HTTPS. Without one, Chrome labels your pages "Not secure", and anything a visitor types into a form travels unencrypted. The good news is that a certificate doesn't have to cost anything. Here's what you need to know about why it matters, and how to check yours.
Quick answer: Yes. Since July 2018 Chrome has marked every HTTP page as "Not secure", and HTTPS protects anything visitors send you. Certificates are available free from Let's Encrypt, and most hosts install and renew them automatically.
Key Takeaways
Chrome has marked every plain HTTP page as "Not secure" since Chrome 68 in July 2018.
HTTPS encrypts what passes between your site and your visitors, including contact form messages.
Let's Encrypt issues certificates free of charge, valid for 90 days.
Google has used HTTPS as a ranking signal since 2014, but it's a lightweight one.
After switching, redirect every HTTP address to HTTPS and fix any mixed content.
What an SSL certificate actually does for your business website
An SSL certificate (strictly speaking, these days, a TLS certificate) lets a browser set up an encrypted connection to your website. The address then starts with https:// rather than http://.
It does two jobs. It scrambles the data passing between your site and the visitor, so it can't easily be read on the way. It also proves to the browser that it's talking to your domain and not an impostor.
What visitors see without it
In February 2018, Google announced that from Chrome 68, released that July, Chrome would mark all HTTP sites as "Not secure" in the address bar. That warning is the first thing a visitor sees before they read a word of your page.
If your site has a contact form, a quote request or a login, the warning matters even more, because the details people type in would travel without encryption.
Is it a legal requirement?
There isn't a law that says "you must use HTTPS". But if your site collects personal data, such as names and email addresses from a contact form, UK GDPR expects you to protect it with appropriate security. Article 32 names encryption as one of the measures to consider.
For most business websites, HTTPS is the simplest and cheapest way to meet that expectation for data in transit.
Does HTTPS help with Google?
Google announced in August 2014 that it had started using HTTPS as a ranking signal. It described it as a very lightweight signal, affecting fewer than 1% of global queries at the time, and said it carried less weight than things like high-quality content.
So HTTPS won't lift a weak page up the results, but there's no good reason to go without it. Page speed matters more to visitors, and our guide to Core Web Vitals explains how it's measured.
How much does a certificate cost?
It can cost nothing. Let's Encrypt, run by the non-profit Internet Security Research Group, doesn't charge for its certificates. Its certificates are valid for 90 days and are designed to be renewed automatically, so your host should handle renewals for you. We cover this in more detail in Who Owns My Website.
Some hosts include a free certificate in every plan, and some charge for a paid one. If yours charges, ask what you get beyond a basic certificate, because for most business websites the free option does the job. We look at website accessibility law for UK businesses in more detail in a separate article.
Switching an existing site to HTTPS
Install the certificate through your hosting control panel, or ask your host to do it.
Redirect every http:// address to the matching https:// address, with a permanent (301) redirect.
Update internal links, images and scripts to load over HTTPS, so the browser doesn't report mixed content.
Check that your robots.txt doesn't block the HTTPS version, and update your sitemap.
Add the HTTPS version to Google Search Console so you can keep an eye on it.
Watch the renewal date
A certificate that expires shows visitors a full-page warning, which is worse than no padlock at all. Check the expiry date in your browser by clicking the padlock, and make sure renewal is automatic.
Related guides
HTTPS is one of the six essentials in our business website checklist.
If your site sets cookies or runs analytics, read our guide to cookie banners and the UK rules as well.
If someone else built your site, make sure your business controls the hosting account where the certificate lives. Our guide to who owns your website explains what to agree in writing.
If you have a question, get in touch with our team.
There is more advice on our blog.
Frequently asked questions
Is a free SSL certificate as secure as a paid one?
For encrypting the connection, yes. A free Let's Encrypt certificate gives the same HTTPS padlock. Paid certificates may come with extra checks or support, which some organisations want.
My site has no forms. Do I still need HTTPS?
Yes. Chrome marks every HTTP page as "Not secure", whether or not it has a form.
How long does a Let's Encrypt certificate last?
90 days. Let's Encrypt recommends renewing about every 60 days, which hosts usually do automatically.
Will switching to HTTPS lose my Google rankings?
Not if you redirect every old address to its HTTPS version with a permanent redirect and don't block the new version from being crawled.
Your next step
Open your website, look at the address bar and click the padlock to check the certificate and its expiry date. If there's no padlock, ask your host to install a free certificate today.
For the background to Chrome's warning, read the Chromium blog's announcement.