Do I Need an SSL Certificate for My Website?
Short answer: yes, every site, and a standard certificate should cost you nothing. Here is what SSL actually does, which paid certificates are worth buying (almost none), and what tends to break when you switch.
Yes. Every website needs an SSL certificate, including a five page brochure site that never takes a payment. Without one, Chrome, Safari and Edge label your site Not Secure in the address bar, and Google treats HTTPS as a ranking signal. A standard certificate should cost you nothing: Let’s Encrypt issues them free and any decent host installs one automatically.
The certificate itself is the boring part. What matters is everything around it: the old links buried in your database, the renewal that quietly fails eighteen months later on a Sunday night. We have cleaned up plenty of those. So here is what the thing does, which paid options are worth real money (very few), and what tends to break on the way across.
What does an SSL certificate actually do?
Two things. It encrypts traffic between your visitor’s browser and your server, so nobody sharing the wifi at the cafe can read what is being typed. And it proves the server answering for yourdomain.com.au is genuinely yours. Encryption is the part people picture. The identity check is arguably the more important half, because without it somebody can sit in the middle, serve their own copy of your site, and collect whatever gets typed into your forms.
One bit of pedantry, so product pages do not confuse you: the protocol has been called TLS since 1999, and every certificate sold today is a TLS certificate. The industry kept saying SSL because that is what people type into Google.
What happens to a site that still runs on http?
Chrome began flagging plain http pages as Not Secure in mid 2018, and every mainstream browser followed. A visitor now reads a warning in the address bar before a single word of your copy. If there is a form on the page, some browsers push a second, blunter warning straight into the field as the cursor lands in it.
We cannot hand you a tidy percentage for lost enquiries, because the visitor who bounces in disgust leaves no trace. What we can say from moving client sites across is that the biggest recoveries come from sites asking for something personal: quote requests, patient intake, finance applications. Anyone already nervous about handing over their mobile number does not need a browser agreeing with them.
If your host charges extra for a basic certificate, that tells you something about the host rather than about certificates. Every plan on our Australian WordPress hosting includes one that installs and renews itself. Ring your current provider and ask what the certificate renewal costs. If the answer has a dollar sign in front of it, ask them why.
Does HTTPS help you rank on Google?
A little. Google confirmed HTTPS as a lightweight ranking signal back in 2014 and has since called it more of a tiebreaker than a lever. Nobody moves from page four to page one by installing a certificate, and any agency implying otherwise is stretching past what the ACCC would call a defensible claim.
The indirect effects are bigger. A botched migration genuinely can cost you rankings, because it splits your site across four addressable versions: http, https, with www and without www. Done properly, with one canonical address and clean 301 redirects pointing at it, HTTPS is neutral to mildly positive. Done sloppily it is a mess that takes weeks to unpick. Small upside, real downside.
Which type of SSL certificate do you actually need?
For almost every Australian small business the answer is a free domain validated certificate from Let’s Encrypt, installed by the host, renewing on its own. That is the whole decision. The certificate types differ in how much checking the issuer does on who you are, not in how strong the encryption is.
| Certificate type | Typical cost (excluding GST) | What gets verified | Who it suits |
|---|---|---|---|
| Domain Validated (DV), free | $0 | Control of the domain only. Automated, issued in seconds | Nearly everyone: brochure sites, WordPress, WooCommerce, booking and enquiry forms |
| Domain Validated, paid | $15 to $80 a year | Exactly the same checks as the free version, plus a support line and a warranty | Businesses on a host that cannot do free certificates, or who want a vendor to ring |
| Organisation Validated (OV) | $90 to $250 a year | Company existence checked against ABN and ASIC records. One to five business days | Larger organisations whose procurement or security policy demands a vetted certificate |
| Extended Validation (EV) | $200 to $600 a year | Full legal, physical and operational vetting. One to three weeks | Banks, insurers and listed companies with a compliance box to tick |
| Wildcard (DV or OV) | $0 free, or $150 to $400 a year paid | Domain control, covering *.yourdomain.com.au | Sites running several subdomains: shop, portal, app, staging |
EV certificates used to buy you the green bar with your company name in it. Chrome removed that display in 2019 and Firefox followed. The visual reward is gone, and that was the entire commercial argument for spending $400 a year. If someone is quoting an EV certificate for a plumbing business or a physio clinic, they are selling, not advising.
Is a paid certificate more secure than a free one?
No. This is the misunderstanding we hear most often, usually from a business owner who has just been upsold. A $600 EV certificate and a free Let’s Encrypt certificate use the same cryptography, the same key strengths and the same protocol. The padlock does not get shinier.
What the money buys is identity assurance and a warranty, plus somebody to phone. Read that warranty before you value it: it generally pays the defrauded end user rather than you, and claims are close to mythical. Need a document for an audit or a government tender? Buy OV. For everyone else the free certificate is not a compromise. It is the same product with a shorter validity, which is a feature, because 90 day certificates force the renewal to be automated.
Do you need a wildcard certificate?
Only if you run subdomains, and only if there are more than one or two. A wildcard covers *.yourdomain.com.au, so shop, portal, staging and app sit under a single certificate instead of four. One website on one domain? Skip it.
There is a catch. Wildcards from Let’s Encrypt need DNS based validation, so whoever renews the certificate needs API access to your DNS. When the domain sits with one company and the hosting with another, that link is exactly where wildcard renewals fall over, usually at 2am. Consolidate the domain and hosting first, or just issue a separate free certificate per subdomain. Costs nothing, breaks less.
What usually breaks after switching to HTTPS?
Three things, and they show up in roughly this order.
Mixed content warnings
The page loads over https but pulls an image, a stylesheet or a script over http. The browser either blocks the file or drops the padlock, so you get a page that looks broken or a padlock that has turned into a warning triangle. Images and web fonts are the usual culprits, along with old map embeds and third party review badges. Chrome tells you precisely which file is at fault: press F12, open the console, read the red lines.
Hardcoded http links in the database
WordPress stores absolute URLs all over the place: post content, widget settings, theme options, serialised Elementor data. Any find and replace has to be serialisation aware, or you corrupt page builder layouts in a way nobody spots until a client opens the page. Better Search Replace or the WP-CLI search-replace command handle it correctly. A blind SQL UPDATE across wp_postmeta does not, and we have watched an entire Elementor site render as empty containers because someone tried. Back up first, every time.
Redirect loops
The classic version: a rule in .htaccess forcing http to https, while a proxy in front of the server has already terminated SSL and is telling WordPress the request arrived as http. The two argue forever and the visitor gets ERR_TOO_MANY_REDIRECTS. If you sit behind Cloudflare, set the SSL mode to Full (strict) rather than Flexible. Flexible causes this exact loop, constantly.
Once the switch is done there is a short admin list nearly everyone forgets: update the site address in WordPress settings, add the https version as a new property in Google Search Console (it counts as a different site), resubmit the sitemap, and change the URL in your analytics and any Google Ads campaigns. None of it is hard. All of it gets skipped. If you would rather not lose a Saturday to it, a managed hosting plan where the certificate is handled for you takes the job off your desk, and our WordPress hosting guides cover the rest of that side of things.
What happens when auto renewal fails?
Your site does not go down, which is almost worse. Every browser throws a full page red warning saying the connection is not private, and the visitor has to find the Advanced link and click through. Practically nobody does. Email clients on the same domain start complaining too, so at least your staff notice.
Let’s Encrypt certificates last 90 days and renew at around day 60. When that fails it is nearly always one of three causes: the domain got pointed somewhere else, a security plugin or firewall blocked the validation request, or a redirect rule broke the /.well-known/ path the renewal check needs. Renewal is silent when it works, which is exactly why nobody notices the day it stops.
Worth doing this afternoon: click the padlock in your browser, open the certificate details and note the expiry date. Put a calendar reminder 30 days before it. If you never hear from your host about certificates, that is only good news when somebody is actively watching them. Sixty seconds of admin beats a Monday morning of angry phone calls.
Do Australian privacy obligations require HTTPS?
The Privacy Act does not name a technology, so nothing in it says the word HTTPS. Australian Privacy Principle 11 requires reasonable steps to protect personal information from misuse, interference and unauthorised access, and sending a contact form across the internet in plain text is not a reasonable step by any sensible reading. The OAIC’s guidance on securing personal information points squarely at encryption in transit as a baseline control.
If your turnover is above $3 million, or you are in health, the Act covers you directly. Smaller businesses have historically sat outside it, though that exemption has been under active review, so it is a poor thing to build a strategy on. Add the Notifiable Data Breaches scheme and an unencrypted enquiry form looks like a cheap risk not worth carrying. General information, not legal advice: if you handle health records or financial data, have someone qualified look at it.
Common questions
How do I check whether my site already has a valid certificate?
Load your site and look at the address bar. A padlock with no warning means it is working. Click the padlock to see who issued the certificate and when it expires. Then test the http version by typing http://yourdomain.com.au directly: it should redirect straight to https, not load a separate copy of the site. If both versions load independently, the redirects are missing and search engines are seeing two sites.
Does an SSL certificate slow my website down?
Not in any way you will notice. The extra handshake adds a few milliseconds on the first connection, and modern HTTP/2 and HTTP/3, which need HTTPS to work at all, usually make the site faster overall than it was on plain http. If a developer tells you HTTPS is hurting your load times, the problem is almost certainly unoptimised images or a bloated plugin stack, not encryption.
Do I need a separate certificate for my email?
Usually not. Mail servers on the same hosting account normally use the certificate covering mail.yourdomain.com.au, which most hosts issue alongside the website certificate. Where it goes wrong is when your website sits with one provider and your mail with another: Outlook or Apple Mail then start warning about a name mismatch. Check your mail client’s server settings use the hostname the certificate actually covers.
My host wants $199 a year for a certificate. Is that ever justified?
For a normal small business site, no. That price usually reflects a control panel that predates free certificates, or a reseller adding margin. Before you pay it, ask whether the plan supports Let’s Encrypt or AutoSSL. If the answer is no in 2026, the certificate charge is a symptom of a bigger problem and the sensible fix is moving hosts, not paying the invoice.
Do I still need HTTPS if my site has no forms at all?
Yes. Browsers flag every http page regardless of what is on it, so a plain information site still carries a Not Secure label. There is a second reason too: without encryption, anyone between your visitor and your server (a dodgy public wifi network, a compromised router) can inject content into your pages. Injected ads and redirects on unencrypted sites are a real and long standing problem.
Will switching to HTTPS cost me my Google rankings?
Not if it is done properly. Google treats an http to https move as a site migration, so you need a single 301 redirect from each old URL to its exact https equivalent, updated canonical tags, and the new property registered in Search Console. Expect some rankings wobble for one to three weeks while Google reprocesses the site, then a return to where you were. Problems come from chained or missing redirects, not from HTTPS itself.
Can I just use Cloudflare's free SSL instead of a certificate on my server?
You can, but install one on the server as well. Cloudflare’s Flexible mode encrypts the visitor to Cloudflare and then sends plain http to your server, which leaves the last leg exposed and frequently causes redirect loops in WordPress. Put a free certificate on the origin server and set Cloudflare to Full (strict). Same cost, properly encrypted end to end, and far fewer strange bugs.
Not sure if your certificate is set up properly?
Send us your domain and we will check the certificate, the redirects and whether anything is still loading over http. Straight answer, no sales pitch. Australian support, no lock-in contracts, and we have been doing this since 2004.