HTTPS has gone from "nice to have for e-commerce" to "expected on every website, full stop" — and for good reason. TLS (the protocol behind the "S" in HTTPS; SSL is its older, now-retired predecessor) does two distinct jobs that are easy to conflate: encrypting data in transit, and verifying you're actually talking to the site you think you are.
Encryption: privacy in transit
Without TLS, everything sent between a browser and a server — form submissions, login credentials, session cookies, page content — travels as plain text. Anyone with access to a point along that network path (a shared Wi-Fi network, a compromised router, an ISP) can read or alter it. TLS encrypts that traffic so it's unreadable to anyone except the two endpoints of the connection.
Authentication: proving identity
A TLS certificate, issued by a trusted certificate authority, cryptographically proves that a domain belongs to whoever holds the corresponding private key. This is what stops (well-configured) browsers from being fooled by a look-alike site impersonating your domain — a real certificate for the real domain can't simply be copied by an attacker.
Why browsers actively punish HTTP now
Modern browsers mark plain HTTP pages as "Not Secure," directly in the address bar, and increasingly restrict or disable modern web features entirely on non-HTTPS origins. Search engines also factor HTTPS into ranking. Skipping it isn't a neutral choice anymore — it actively costs you trust and visibility.
Certificate types, briefly
- Domain Validation (DV) — confirms you control the domain. Fast to issue, and what most sites (including free options like Let's Encrypt) use.
- Organization Validation (OV) — additionally verifies the requesting organization is real.
- Extended Validation (EV) — the most rigorous vetting, historically shown with extra visual indicators, though most browsers no longer display those distinctly.
For the overwhelming majority of sites, a DV certificate provides exactly the same encryption strength as the more expensive options — the difference is entirely in identity vetting, not in how well your traffic is protected.
A certificate confirms you're talking to the domain it says you are. It says nothing about whether that domain is trustworthy — that part is still on you.
The practical takeaway
Get a certificate (free options like Let's Encrypt make this a non-issue cost-wise), set up automatic renewal so it never silently expires, and redirect all HTTP traffic to HTTPS. It's one of the highest-value, lowest-effort security decisions any website can make.