Why HTTPS Is Not Optional Anymore
In 2014, Google announced HTTPS as a ranking signal. In 2018, Chrome began marking HTTP sites as Not Secure. The trajectory is clear: HTTP sites face search ranking penalties and browser warnings. The good news is that securing your site with SSL has been free since 2016 when Let’s Encrypt launched.
How SSL Certificates Actually Work
When your browser connects to an HTTPS website, a cryptographic handshake happens in milliseconds. Your browser requests the site’s SSL certificate, verifies it was issued by a trusted Certificate Authority, and both sides establish an encrypted connection. Everything between the visitor’s browser and your server — passwords, form submissions, payment details — is encrypted.
Types of SSL Certificates
Domain Validation (DV) — The most common type. Verifies you control the domain. Free from Let’s Encrypt. Appropriate for the vast majority of websites.
Organization Validation (OV) — Verifies the organisation behind the domain. Appropriate for corporate websites and SaaS products. Costs $50–$300/year.
Extended Validation (EV) — The most rigorous verification. Previously showed a green address bar but most browsers removed this visual in 2019, reducing justification for the higher cost.
Let’s Encrypt: Free SSL for Everyone
Let’s Encrypt is a non-profit Certificate Authority backed by Mozilla and the EFF. It issues free Domain Validation SSL certificates trusted by all major browsers. Certificates are valid for 90 days but auto-renew automatically through your hosting control panel.
How to Get Your Free SSL Certificate
On quality shared hosts like Hostinger, SiteGround, and Bluehost, the process is automatic. SSL is either enabled by default or available with a single click in cPanel. For VPS hosting using Certbot on Ubuntu with Nginx:
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comCertbot installs the certificate, configures Nginx, and sets up automatic renewal. The entire process takes under five minutes.
Forcing HTTPS in WordPress
Installing an SSL certificate is not enough — you also need to redirect all HTTP traffic to HTTPS. Add this to your .htaccess above the WordPress rules:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Alternatively, the Really Simple SSL plugin handles this automatically and also fixes mixed content warnings by scanning and updating internal HTTP links.
