When a website opens with https:// and the browser does not complain, an SSL certificate is working behind the scenes (more precisely TLS — but the old name stuck). Without one, browsers mark the website as “Not secure”, and visitors leave before they read anything.
In short
- The certificate encrypts the connection between the visitor and the website and proves that the browser is really talking to your domain.
- Every website needs one, not just online stores: contact forms and passwords also travel over the connection.
- A Let's Encrypt certificate is free and provides the same encryption as a paid one.
- At NBT Host, the certificate is issued and renewed automatically for every domain and subdomain.
What it actually does
Without a certificate, everything the visitor sends — the name in a form, the customer account password, the delivery details — travels unencrypted. Anyone along the way, for example on a public Wi-Fi network, can read or change it.
With a certificate, two things happen:
- Encryption: the data travels encoded and cannot be read along the way.
- Identity verification: a certificate authority has confirmed that the certificate was issued for your domain. The browser checks this on every visit.
Why you want one even if you sell nothing
- Browsers: Chrome, Safari, Firefox and Edge show “Not secure” next to addresses without HTTPS, especially on pages with forms.
- Google: HTTPS is one of the signals the search engine takes into account.
- Modern features: many browser features only work on secure pages.
- Trust: a visitor who sees the warning will not fill in your contact form.
Let's Encrypt or a paid certificate?
Let's Encrypt is a nonprofit certificate authority that issues free domain-validated (DV) certificates. The encryption is the same as with a paid certificate. Its certificates are valid for a short period, which is why they renew automatically — and that is an advantage: you never forget to renew one.
A paid certificate makes sense in a few cases: when you need organization validation (OV) or extended validation (EV), meaning your company details are verified by the certificate authority; when a partner or a contract requires a specific type of certificate; or when you want the financial warranty some issuers offer. For the vast majority of business websites and online stores, Let's Encrypt is enough.
How it works at NBT Host
On every hosting plan, Enhance automatically requests a Let's Encrypt certificate for every domain and subdomain as soon as the domain points to our server, and renews it on its own. Until it receives it — usually a few minutes — it uses a temporary one that browsers do not accept. How to check that everything is in order and what to do when it does not appear: the free SSL certificate guide.
The padlock is there, but the site still says “Not secure”
The usual causes:
- Mixed content: the page is on
https://, but it loads images or scripts fromhttp://. In WordPress, the site address in the settings has usually stayed onhttp://. - The redirect is missing: the website also works on
http://, and visitors land on the unsecured version. The fix is a redirect to HTTPS, described in redirecting to HTTPS and www. - The domain has just been moved: the certificate is issued after DNS points to the new server; if propagation has not finished yet, you wait a little longer. More about moving in moving your website without downtime.
- The
wwwversion: ifwww.domeniu.rois not added to the website, it has no certificate either.
What a certificate does not do
SSL does not make a website “secure” in the broad sense. It does not stop a vulnerable plugin, a weak password or an attack on the admin panel. It is one piece among several — along with updates, strong passwords, two-factor authentication and backups.