HTTPS is the secure version of the protocol your browser uses to talk to a website. It encrypts and protects the connection, and an SSL (strictly, TLS) certificate is what lets the site prove it is the one the visitor intended to reach. Every business website needs it, not only shops and login pages. The practical risk for owners is not setting it up, which is usually straightforward, but letting the certificate expire or renewal quietly fail.
What HTTPS actually does
Web.dev, Google’s web developer guidance, says HTTPS helps prevent intruders from tampering with communication between your site and your users’ browsers, and prevents intruders from passively listening to that communication. It adds that every unprotected HTTP request can potentially reveal information about users’ behaviours and identities, so protection applies to every site, not only those handling sensitive data (web.dev).
In plain terms, three things are being protected:
- Privacy: others on the network cannot read what is exchanged.
- Integrity: the page cannot be altered on its way to the visitor, for example by something injecting ads.
- Identity: the certificate helps show the visitor is connected to the real site and not an imitation.
The same article notes that HTTPS is a key component of the permission workflows for new and updated browser features.
SSL, TLS and certificates, briefly
People still say “SSL certificate”, but SSL is the older name. Current secure connections use TLS. When you buy or obtain an “SSL certificate” you are getting a TLS certificate. The certificate is issued by a certificate authority after it checks you control the domain, and it is valid for a limited period. Domain choice matters here too; see choosing a .com.au domain.
Why it matters for a business
- Trust. Browsers warn visitors when a connection is not secure or a certificate has expired. A warning page in front of your site can turn away customers.
- Form and enquiry safety. Contact forms, bookings and logins send personal details.
- Compatibility. Some browser features need HTTPS.
- Search. Google’s site move guidance treats HTTP to HTTPS as a routine change that does not require the change of address tool, which signals it expects sites to make the move (Google Search Central). Do not expect HTTPS alone to lift rankings noticeably.
HTTPS does not make a site safe in every respect. It protects the connection, not the code, the plugins or the server. A secure padlock on a compromised site is still a compromised site.
How certificates are obtained
Most hosts now provide certificates automatically. Let’s Encrypt, a free nonprofit certificate authority, states that its default certificates are valid for 90 days, that lifetimes cannot be adjusted, and that it recommends renewing 90-day certificates every 60 days, with renewals automated by ACME clients (Let’s Encrypt FAQ). Paid certificates from other providers typically need renewing on their own schedules, so find out which applies to you.
Renewal pitfalls
| Pitfall | Why it happens | Prevention |
|---|---|---|
| Expired certificate | Manual renewal forgotten, or renewal silently failing | Automate renewal; add monitoring |
| Notices go to a former employee | Contact email is stale | Use a shared role mailbox |
| Renewal blocked | Firewall or DNS changes break domain validation | Test renewal after any hosting or DNS change |
| Mixed content | Pages load images or scripts over plain HTTP | Update links; test key pages |
| Only the main site covered | Subdomains or www variants left out | List every hostname in use |
Let’s Encrypt community discussion notes that its expiration emails are no longer meant as a backup monitoring service, and that users are pointed to monitoring options instead (Let’s Encrypt Community). That thread is a community post, not an official policy page, so check Let’s Encrypt’s own documentation for details. The lesson holds regardless of provider: do not rely on an email nudge.
A simple owner’s checklist
- Visit your site and each important hostname in a browser and confirm the secure indicator.
- Find out who issues and renews your certificate (host, CDN or manual).
- Record the expiry date and a named owner.
- Set an alert for expiry well ahead, such as two to four weeks, using a monitoring tool.
- Redirect HTTP to HTTPS using permanent redirects.
- Re-test after any host move, DNS change or redesign.
- Keep plugins, software and server up to date.
Does HTTPS affect speed?
Modern HTTPS adds little overhead in normal setups, and performance depends far more on page weight, images and scripts. See website speed and Core Web Vitals for what to measure.
Where Radiance Impact fits
Radiance Impact’s Technology division builds business websites and offers maintenance and care. If you want a second pair of eyes on your site’s set-up, see Technology or contact us.
Sources
- Why HTTPS matters, web.dev
- Let’s Encrypt FAQ, Let’s Encrypt
- Site moves with URL changes, Google Search Central
- Bad news for many: end of expiration emails, Let’s Encrypt Community
