Every website your customers visit gets judged in about a second, and part of that judgment happens in the address bar. A small lock icon, or a gray “Not secure” label, tells people whether the page they are on can be trusted with their name, email or card number. Most visitors never think about it until something looks wrong, and then they leave.

That little signal comes from HTTPS and the SSL certificate behind it. You do not need to understand the technology to manage it well. You need to know what it does, how to check yours, and what to watch so it never lapses. Here is the plain version.

What HTTPS and an SSL certificate actually do

When someone loads your site, their browser and your web server send information back and forth. Without HTTPS, that information travels as plain text that anyone on the same network, like a coffee shop’s public Wi-Fi, could read or alter. With HTTPS, it is scrambled so only the browser and your server can read it.

The SSL certificate is the small file on your server that makes this possible. It does two jobs. It proves your site is really your domain and not an impostor, and it holds the keys used to encrypt the connection. Technically today’s certificates use a newer standard called TLS, but nearly everyone, including hosting companies, still calls them SSL certificates. They are the same thing for your purposes.

One point worth knowing: a certificate protects the connection, not the whole site. It keeps a contact form submission private on its way to you, but it does not stop someone from guessing a weak admin password or exploiting an old plugin. HTTPS is one layer of security, not all of it.

What the padlock means, and what it does not

Back in 2018, Google’s Chrome browser started labeling every page without HTTPS as “Not secure,” and other browsers followed. Today, HTTPS is simply expected. Some browsers have even replaced the padlock with a neutral icon, because a secure connection is now the normal state rather than a badge of honor.

So what should you take from the icon?

• A padlock or tune icon. The connection between the visitor and your site is encrypted, and the certificate is valid for your domain.
• “Not secure” in gray or red. The page loaded over plain HTTP, or it is asking for information on a page that is not encrypted. Visitors see this before they see your logo.
• A full-page warning. Messages like “Your connection is not private” mean the certificate is expired, missing or issued for a different domain. Most people close the tab immediately.

The padlock does not mean a business is honest or that the site is safe in every way. Scam sites can have valid certificates too. For your own site, though, it is the minimum a visitor expects before they fill out a form or call the number on the page.

How to check your own site in five minutes

You can test this yourself without logging into anything. Grab your phone and a computer and walk through these steps:

1. Type the plain address. Enter yourdomain.com with no “https” in front. The browser should land on the https version automatically. If it stays on http, your redirect is missing.
2. Try the www and non-www versions. Both www.yourdomain.com and yourdomain.com should open the same secure page with no warning.
3. Click the icon in the address bar. Most browsers show “Connection is secure” and let you view the certificate, including who issued it and the date it expires.
4. Visit your busiest pages. Check the contact page, any donation or checkout page, and a blog post. A page can show a warning when it loads an old image or script over http. This is called mixed content.
5. Look at it on mobile data. Turn off Wi-Fi on your phone and load the site again, so you see what a customer on the go sees.

If every step passes, you are in good shape. If one fails, note which step and send it to whoever manages your hosting. That detail saves a lot of back and forth.

Why certificates expire and how renewals work

Certificates are issued for a limited time on purpose. Short lifetimes mean a stolen or mistaken certificate cannot be misused for long. Most certificates now last about three months to a year, and the industry is moving toward even shorter terms, which makes automatic renewal close to required.

Many hosts issue free certificates through Let’s Encrypt and renew them on their own. That works well until something quietly breaks it: the domain’s DNS gets moved, a new subdomain is added, or a hosting plan changes. The certificate then expires on a weekend and the warning page greets every visitor until someone notices.

To stay ahead of it, find out three things from your host or web team: who issued your certificate, whether it renews automatically, and who gets the email if renewal fails. Put the expiration date on your calendar as a backup. If you bought a paid certificate years ago, ask whether a free automatic one would do the same job. For most small business, church and nonprofit sites, it will.

Common problems after moving to HTTPS

Turning on a certificate is usually quick. Cleaning up afterward is where sites get stuck. Watch for these:

• Mixed content. Old posts or page builders may still point images and scripts to http addresses. Update them in the site’s database or settings, not one page at a time.
• Redirect loops. If the site, a plugin and a service like Cloudflare all try to force HTTPS, pages can bounce endlessly. One layer should handle it.
• Analytics and search records. Make sure Google Search Console has your https address and your sitemap lists https links, so search results point to the secure version.
• Forms and embeds. Third-party booking, giving or payment widgets need https sources too, or browsers may block them.

If you are planning a bigger change at the same time, our guide on keeping your search traffic during a redesign covers the redirects and checks that protect your rankings.

Make it part of regular care, not a one-time fix

HTTPS works best when someone checks on it along with everything else: plugin updates, backups, uptime and form tests. A certificate that renews on its own still needs a person who would notice if it stopped. If your site has gone a while without that kind of attention, it is worth reading what regular website maintenance includes.

At Circles Co, every site on our hosting and care plans gets an automatically renewing certificate and someone watching it, so a warning page never becomes your customers’ first impression.

Your next step

Take five minutes today and run the checks above on your own site. Write down your certificate’s expiration date and who is responsible for renewing it. If anything shows a warning, or you are not sure who manages your hosting, that is the moment to sort it out, before a visitor finds the problem for you.