Why this matters
The padlock is table stakes. Browsers flag plain-HTTP pages as "Not secure," which is a trust-killer next to a form asking for someone's name and phone number. Google has also used HTTPS as a ranking signal since 2014. Skipping SSL costs you both trust and visibility.
What "done" looks like
- Your site loads with the padlock at your real domain
- Typing the http:// version redirects automatically to https://
- No "mixed content" warnings from images or scripts loading over HTTP
- Certificate renewal is automatic, and backups are turned on
How to do it
- Check your platform first. Hosted builders (Squarespace, Wix, Shopify) include SSL automatically once your domain is connected — just verify the padlock.
- Pick a reputable host if self-hosting WordPress; most mainstream hosts bundle free certificates from Let's Encrypt, the nonprofit certificate authority.
- Enable the certificate and force HTTPS so every HTTP request redirects to the secure version — one toggle on most hosts.
- Hunt mixed content. If the padlock doesn't show, some image or script is still loading over HTTP; update those URLs.
- Confirm auto-renewal. Let's Encrypt certificates are short-lived by design; automation must renew them or the site will start throwing warnings.
- Turn on backups while you're in the hosting panel.
Common mistakes
- Buying an expensive certificate a free Let's Encrypt one would cover
- Installing SSL but never redirecting the HTTP version, so both exist
- Letting a certificate lapse and greeting customers with a browser warning
Real-world examples
- Google announced HTTPS as a ranking signal on its official blog in August 2014 — lightweight, but real and documented.
- Let's Encrypt has issued free certificates since 2015 — the reason SSL is no longer a line item for most sites.
From a founder's point of view
Nobody chooses a business because of its padlock, but people absolutely leave because of a security warning. This is pure downside-removal: an hour once, then automation.
Rule of thumb
Padlock on every page, http:// redirects to https://, renewal automatic. All three, or it isn't done.