Short answer: for most corporate sites, blogs and small online stores, a free SSL certificate is enough. Paid certificates don't provide stronger encryption; the difference lies in how much the issuer verifies about you and the extra services it offers.
As an agency, we often see one line in quotes clients show us: a yearly paid SSL fee. Sometimes it is genuinely needed, usually not. Here is how to tell.
What does SSL do?
SSL (technically TLS today) encrypts traffic between the visitor's browser and your server. When someone types their name, phone or card details into a form, the data can't be read in transit. The https and padlock in the address bar show this.
Its second job is identity. The certificate confirms that the server you reached really belongs to that domain.
On a site without SSL, common browsers show a Not secure warning in the address bar. Google also announced years ago that it uses HTTPS as a ranking signal. Today, SSL isn't an option, it is the minimum.
DV, OV and EV
Certificates come in three validation levels.
DV (domain validated): The issuer only checks that you control the domain. Usually issued automatically within minutes. Free certificates such as Let's Encrypt are this type.
OV (organisation validated): The company's legal existence is also checked with documents. It can take a few days. The company name appears in the certificate details.
EV (extended validation): The strictest check. Browsers used to show a green company name in the address bar, but major browsers have dropped that display. Today a visitor sees almost no visual difference between EV and DV.
All three use the same encryption technology.
When is a free certificate enough?
A brochure site, a blog, a clinic site with a booking form, a small online store whose payment integration collects card data on the payment provider's own page. For all of these, a free DV certificate is usually enough. In that setup card data never reaches your server.
The cases for a paid certificate are narrower: corporate clients or a tender requiring OV/EV, wanting to cover many subdomains with one certificate when your hosting doesn't support free ones, or finance projects where a certificate warranty is contractually required.
Free certificates are short-lived, a few months with providers like Let's Encrypt, and validity periods across the industry keep getting shorter. That's fine because renewal is automatic. The real risk is automatic renewal breaking after a server move. Keep the certificate expiry date on your maintenance checklist.
The Not secure warning and how to fix it
If you see the warning even with a certificate installed, the cause is usually one of these:
- Mixed content: the page loads over https, but an image, script or font still loads from an http address. The Console tab in your browser's developer tools names the file.
- Expired certificate: automatic renewal didn't run.
- Domain mismatch: the certificate covers example.com but the site opens with www, or the other way round.
- No redirect from http to https: the site opens at both addresses.
Most of these are fixed from the hosting panel or with a few lines of server configuration. Our hosting comparison covers how hosting types differ in SSL support, and our security article lists other measures to protect your site.
Frequently Asked Questions
Does an SSL certificate protect my site from being hacked?
No. SSL only encrypts data in transit. Outdated plugins, weak passwords or server vulnerabilities need separate security measures.
Is a paid SSL certificate required for an online store?
Usually not. If card data is collected on the payment provider's page, a free DV certificate is often enough. If you process card data on your own server, much broader security standards apply; clarify this with your payment provider.
Will my Google rankings drop after installing SSL?
If the http addresses redirect permanently (301) to the https versions and the move is done correctly, a lasting drop isn't usually expected, though short fluctuations can occur during the switch. Afterwards, resubmit the sitemap with the new addresses in Search Console.
Blog posts are for general information only and are not a substitute for legal, financial or technical advice.
