If your site still loads over plain HTTP, browsers are telling visitors it is "Not secure" before they read a word of your content. There is no reason to pay for a basic certificate and no reason to be without one - a free certificate from Lets Encrypt is technically identical to a paid one for what most sites need.
What SSL actually does
It encrypts traffic between the visitor and your server, so a network in between cannot read or alter it. That is the whole promise, and it matters more than people think on shared networks and mobile connections.
Just as important, what it does not do:
- It does not make your site secure. An outdated WordPress plugin is just as exploitable over HTTPS.
- It does not prove the business behind the site is legitimate. A basic certificate verifies control of the domain, nothing more.
- It does not make your site faster on its own - although HTTP/2 and HTTP/3, which need HTTPS, generally do.
Where free certificates come from
Lets Encrypt is a non-profit certificate authority that issues domain-validated certificates at no cost, trusted by every mainstream browser. Certificates last 90 days and are meant to be renewed automatically - which is the part that matters. A certificate you have to remember to renew is a certificate that will expire on a holiday.
ZeroSSL is a similar alternative. Cloudflare also terminates TLS at its edge for free if your domain is proxied through it.
Getting one, three ways
Through your hosting panel (easiest)
Any modern panel does this in a click. In AstraCloud Panel, SSL is issued automatically when a domain is added and pointed at the server, and renewed without anyone touching it - so on our hosting plans there is nothing to do at all. If your provider charges extra for a basic certificate in 2026, that is a reason to leave.
On your own server with certbot
If you run a VPS without a panel, certbot obtains and installs the certificate and adds a renewal timer. It needs port 80 reachable for the standard validation, or DNS access for wildcard certificates.
Through Cloudflare
Proxying through Cloudflare gives visitors HTTPS at the edge for free. Set the encryption mode to Full (strict) and keep a real certificate on the origin as well - the mode that leaves the origin unencrypted is a false sense of security, not security.
When you should pay
Rarely, and for specific reasons:
- Wildcard certificates if you cannot automate DNS validation - although Lets Encrypt issues these free when you can.
- Organisation validation when a contract or a regulator asks for the company identity in the certificate.
- A warranty - largely a commercial artefact rather than a technical one.
For a normal business site, shop or blog, a free domain-validated certificate is the correct choice and nothing is missing.
The three things that break after switching
1. Mixed content
The page loads over HTTPS but pulls an image, script or stylesheet over HTTP, and the browser blocks it or drops the padlock. Fix it by updating the URLs in your content and theme - for WordPress, a search-and-replace across the database from http:// to https:// for your own domain.
2. No redirect
Both http:// and https:// keep working, so you now have two versions of every page. Force a permanent redirect to HTTPS and set the canonical URL to the HTTPS version.
3. Hard-coded site URL
WordPress in particular stores its address in the database. Update both the site address and home address, or you get redirect loops.
After it works
- Update your sitemap and Search Console property to the HTTPS version.
- Check the renewal actually runs before the first 90 days are up.
- Consider HSTS once you are confident everything is on HTTPS - it tells browsers never to try HTTP again, and it is deliberately hard to undo.
Questions
Is a free SSL certificate as good as a paid one?
For encryption, yes - identical. Paid certificates add identity validation and warranties, which most sites do not need.
Does SSL help SEO?
HTTPS is a confirmed, if small, ranking signal. The bigger effect is behavioural: visitors leave when a browser warns them.
Do I need SSL if I do not take payments?
Yes. Browsers mark plain HTTP as not secure regardless of what the site does, and any login form at all sends a password in the clear without it.
Is SSL included with AstraCloud hosting?
Yes, on every plan, issued and renewed automatically at no cost - including on VPS servers running our panel.