When customers visit your website, they trust that anything they enter — their name, email address, enquiry, or payment details — goes directly and privately to you. If your site does not use HTTPS, that assumption is wrong. The data travels across the internet in plain text, readable by anyone who intercepts it along the way.

This is not a theoretical risk. It costs businesses customers, search rankings, and in some cases, regulatory fines.

What Is HTTPS and How Does an SSL Certificate Work?

HTTPS is the secure version of HTTP, the protocol used to load websites. The S stands for Secure, meaning the connection between your visitor’s browser and your web server is encrypted using TLS (Transport Layer Security).

The visible sign of HTTPS is the padlock icon in the browser address bar. Without it, modern browsers — Chrome, Firefox, Edge, and Safari — display a “Not Secure” warning instead.

An SSL/TLS certificate is what enables HTTPS. It serves two functions: it encrypts the connection between visitor and server, and it verifies that the website is genuinely operated by who it claims to be.

What Happens to Your Business Without HTTPS?

Data is exposed in transit. Every form submission, search query, and field a visitor completes is sent unencrypted. On a public Wi-Fi network — in a café, hotel, or airport — anyone on the same network with basic tools can read that data. This is a man-in-the-middle attack, and it requires no particular skill to carry out.

Browsers warn your visitors away. Since 2018, Google Chrome has displayed “Not Secure” prominently for all HTTP sites. Research consistently shows that more than 80% of users will abandon a site after seeing a security warning. These are paying customers walking away before they have read a word.

Google penalises you in search rankings. HTTPS has been a ranking signal since 2014. HTTP sites are at a direct disadvantage compared to equivalent HTTPS sites. If you are investing in SEO, an unencrypted website is quietly undermining that investment.

You may be breaching UK GDPR. The UK GDPR requires that personal data be processed securely. Transmitting data from a contact form without encryption is a failure to implement appropriate technical measures. The Information Commissioner’s Office (ICO) can investigate and fine businesses for breaches caused by inadequate security.

The Cost When It Goes Wrong

In 2018, British Airways suffered a data breach in which attackers injected malicious code into their payment page. The ICO fined British Airways £20 million (reduced from an initial £183 million notice) under GDPR. For smaller businesses the headlines may not appear, but the proportional damage — ICO investigations, reputational harm, and lost customer trust — can be equally devastating at a smaller scale.

Not All SSL Certificates Are Equal

There are different levels of SSL certificate, and it is worth knowing which you need:

  • Domain Validation (DV): Verifies you control the domain. Available free via Let’s Encrypt. Provides encryption but no deeper identity verification. Suitable for most small business websites.
  • Organisation Validation (OV): Verifies the domain and the organisation behind it. Better for business sites handling sensitive enquiries.
  • Extended Validation (EV): The highest level, showing the company name in some browsers. More expensive and less commonly used than it once was.

For most small business websites, a free Let’s Encrypt DV certificate is a significant improvement over no certificate at all.

What to Do Next

  • Check whether your site uses HTTPS. Visit your website and look at the address bar. If it shows “Not Secure” or starts with http://, you need to act.
  • Get an SSL certificate. Most hosting providers include free Let’s Encrypt certificates and can enable HTTPS with a single click. If yours does not, it may be time to switch.
  • Force HTTPS redirects. Configure your server to automatically redirect any HTTP request to HTTPS, so visitors always land on the secure version.
  • Set up HSTS. The HSTS security header tells browsers to always use HTTPS for your domain, preventing downgrade attacks even when someone types your address without https://.
  • Check your certificate expiry. SSL certificates expire — every 90 days for Let’s Encrypt, every one to two years for paid certificates. An expired certificate triggers browser warnings just as severe as having no certificate. Most hosts auto-renew, but it is worth confirming.

HTTPS is not optional for a credible business website. It is expected, free in most cases, and the consequences of not having it — in lost visitors, search rankings, and regulatory risk — far outweigh the minimal effort to set it up.

W3IT’s free security check will verify whether your website has a valid HTTPS certificate and whether it is correctly configured. Run it now and see exactly what your visitors see.