If your website shows “Not secure” in the browser bar, this guide on how to add an SSL certificate to your website is exactly what you need. That warning costs you trust — and probably customers — every day it stays. The fix is an SSL certificate, which switches your site to HTTPS and shows the reassuring padlock instead, and for most websites adding one is free and takes minutes. Here is the step-by-step.
What SSL Actually Does
An SSL certificate encrypts the connection between your website and each visitor, so information (like a contact form or payment) cannot be read in transit. Browsers show a padlock for secured sites and a “Not secure” warning for those without — and Google uses HTTPS as a ranking signal. In short, SSL is no longer optional for any real website.
Step 1: Check If You Already Have One (Free)
Most good hosts now include a free SSL certificate (via Let’s Encrypt) with every hosting plan — you may already have it and just need to switch it on. Log into your hosting control panel and look for an “SSL/TLS” or “Let’s Encrypt” section. If it is there, you rarely need to buy anything. Only specific cases (large ecommerce, multiple subdomains, or organisations needing extra validation) call for a paid certificate.
Step 2: Install / Activate It
In your host’s SSL panel, issue or enable the free certificate for your domain. On managed WordPress hosting this is often a single toggle. Once issued, the certificate covers your domain and your site can be served over HTTPS.
Step 3: Switch WordPress to HTTPS
Having the certificate is not enough — your site must actually load over https://. In WordPress, update the Site Address and WordPress Address (Settings → General) to the https:// version, then use a plugin like “Really Simple SSL” to catch any remaining http:// links and redirect all traffic to the secure version automatically. This avoids “mixed content” warnings where some elements still load insecurely.
Step 4: Test and Confirm
Visit your site and confirm the padlock shows on every page, not just the homepage. Check a few internal pages, and make sure the “Not secure” warning is gone. If a page still shows a warning, it usually has an image or script loading over http:// — the SSL plugin above normally fixes this.
Free vs Paid SSL — Which Do You Need?
For the vast majority of business websites, a free certificate (Let’s Encrypt, included by most hosts) is genuinely all you need — it provides the same encryption and the same padlock as a paid one. Do not let anyone upsell you a certificate you do not need. A paid certificate is only worth it in specific cases: large ecommerce sites wanting extended validation (the company name shown), businesses needing to secure many subdomains with a wildcard certificate, or organisations with compliance requirements. If you are a normal small business site, free is not a lesser option — it is the right one.
A Note on SEO
Moving to HTTPS is a change of address in Google’s eyes, so do it properly: keep redirects in place so old http:// links still work, and update your sitemap. Done correctly there is no ranking loss — in fact HTTPS helps. Done carelessly (no redirects) you can lose traffic, which is the one thing to be careful about.
Does SSL Slow My Site Down?
A common worry, and the answer is effectively no. Modern HTTPS adds a tiny, unnoticeable overhead — and in practice secure sites can load faster, because HTTPS is required to use the faster HTTP/2 protocol most servers now run. So there is no speed reason to avoid SSL; the encryption cost is negligible and the trust and ranking benefits are real.
If It Is Not Straightforward
Most sites are a quick job, but older sites, custom setups, or ones with lots of hard-coded links can throw up mixed-content issues that are fiddly to chase down. If the padlock will not go green or the site breaks, our hosting and domain support sorts it out, and keeping SSL valid and renewed is part of ongoing security maintenance.
Site showing “Not secure” and not sure how to fix it? We install SSL and move your site to HTTPS cleanly — no lost rankings, no broken links. See our hosting and domain support or message us on WhatsApp.