SSL certificates: do you need to buy one?

Yes, your website needs an SSL certificate, but you almost certainly do not need to buy one. The certificate is what makes your address start with https and shows the padlock, and without it browsers label your site "Not secure". Nearly every website builder and host now provides one automatically, at no extra charge, and renews it for you. If someone is trying to sell you a certificate for a normal small-business website, check what you already have first.

What an SSL certificate does, plainly

When someone visits your website, their phone or computer and your website's server exchange information. An SSL certificate (the newer name is TLS, but everyone still says SSL) does two things:

It scrambles the connection, so nobody on the same coffee-shop wifi can read what is being sent, such as a contact form message.
It proves the site is really yours, because a recognized company checked that whoever asked for the certificate controls your domain.

Visitors see it as the https:// at the start of the address and a padlock or settings icon next to it. Without a certificate, Chrome, Safari and Edge show "Not secure" next to your address, and some browsers warn before letting people submit a form.

Why most owners do not need to pay

A free organization called Let's Encrypt has issued certificates at no cost for years, and other providers do the same. Hosting companies and website builders built this into their service, so:

Website builders such as Wix, Squarespace, Weebly, Shopify and GoDaddy's builder add a certificate automatically for your domain.
Most web hosts include free certificates on their plans, often with a switch labeled SSL, Let's Encrypt or AutoSSL in the control panel.
Cloudflare, if your domain uses it, provides a certificate for visitors at no charge.

These free certificates give the same padlock and the same encryption as paid ones. Visitors cannot tell the difference.

How to check what you have right now

Type your address into your phone's browser with https:// at the start.
If the page opens with a padlock and no warning, you have a working certificate.
Tap the padlock or the icon left of the address. Look for "Connection is secure" and, on most browsers, a "certificate is valid" detail with an expiry date.
Now type the address with http:// instead. A good setup immediately switches you to https. If it stays on http and shows "Not secure", the certificate exists but the site does not force it; your host or builder usually has a setting called "force HTTPS" or "redirect to HTTPS".
Try with www. in front as well. Both versions need to work.

When people try to sell you one

Hosts and registrars often offer paid certificates at checkout or by email. Common pitches and what they really mean:

"Protect your customers' data." The free certificate protects it equally.
"Get the trusted green bar." Browsers removed the special green bar for extended-validation certificates years ago. Your visitors will not see a difference.
"Higher warranty." Paid certificates come with a warranty paid out to visitors if the certificate authority makes a mistake. For a small business website, that has little practical value.
"Your certificate is expiring, renew now." Check whether this is from your actual host. Fake renewal emails are common. Phishing emails about your domain or website shows how to spot them.

If you already pay for a certificate every year, ask your host whether you can switch to the free one. Usually you can, with no change for visitors.

When a paid certificate does make sense

There are a few honest cases:

Your host does not offer free certificates and you have reasons not to move. A cheap basic certificate is fine then, though moving host is often the better answer.
A business customer or contract requires an organization-validated certificate, which lists your company's verified name inside the certificate details. This occasionally comes up with insurers, government suppliers or financial firms.
Special setups, like many subdomains on a single custom server, where a paid wildcard certificate can be simpler. Most small businesses never meet this.

Expiry and renewals

Certificates do not last forever. Free ones typically last about three months and renew automatically. The industry is moving toward even shorter lifetimes, which makes automatic renewal the only sensible approach.

When renewal fails, visitors suddenly see a full-page warning that the connection is not private. Most of them leave. Causes to know:

Your domain's DNS was changed to point somewhere else, so the host can no longer prove you own the domain.
A builder or host account was downgraded or a payment failed.
A manually installed paid certificate reached its date and nobody renewed it.

Keep the host's renewal emails going to an address someone reads, and check the padlock from your phone every month or so.

SSL when you change website or forward a domain

Each domain and subdomain that visitors can reach needs its own working certificate, including domains that only forward to your main site. When you point your domain at a new website, the new host issues a fresh certificate, usually within minutes to an hour; a brief warning during that window is normal. A forwarded second domain can show a warning if the forwarding service does not support https, which domain forwarding explained covers. And HTTPS and the padlock goes into why browsers and visitors care.

Your five-minute check

Open https:// plus your domain on a phone and look for the padlock.
Try http:// and check it switches to https.
Try the www version too.
Check any second domains or subdomains you use.
Look at your hosting bill for a certificate charge you might not need.

A website that still shows "Not secure" is often an older one that needs more attention than a certificate. If that sounds like yours, you can see your site rebuilt first, already on https, before deciding anything.