SSL Basics
What Is an SSL Certificate, and Why Every Site Needs One
The padlock in a browser bar isn't decoration — it's proof that traffic between a visitor and your server is encrypted and that the certificate was verified.
Free
Auto-renewing SSL included
256-bit
Typical modern SSL/TLS encryption
24/7
Human support for setup questions
30-day
Money-back guarantee
In short
An SSL certificate is a small data file installed on a web server that enables HTTPS: it encrypts data traveling between a visitor's browser and the server, and proves the site's identity was verified by a certificate authority. Without one, browsers mark a site 'Not Secure,' data like passwords and card numbers can be intercepted in plain text, and search engines rank the site lower than HTTPS equivalents.
SSL certificates come in three verification levels — Domain Validated (DV), Organization Validated (OV), and Extended Validation (EV) — which differ in how thoroughly the certificate authority checks who's behind the domain before issuing it.
SSL (Secure Sockets Layer, technically superseded by TLS but still called SSL out of habit) exists to solve one specific problem: without it, everything sent between a browser and a web server — form submissions, login credentials, credit card numbers, even the pages themselves — travels as plain, readable text. Anyone positioned between the two, on a shared coffee-shop Wi-Fi network or a compromised router, can read or alter that traffic. An SSL certificate encrypts the connection so intercepted data is unreadable gibberish, and it also cryptographically confirms that the site a visitor reached is actually the one they meant to reach, not an imposter intercepting the request.
You've seen the visible effects of this even if you've never thought about the mechanism: the padlock icon next to a URL, the 'https://' prefix instead of 'http://', and the browser's blunt 'Not Secure' warning on sites that lack a certificate. What most site owners don't know is that not all certificates are equal — a DV certificate on a personal blog and an EV certificate on a bank's login page are solving the same encryption problem but proving very different levels of identity verification.
How SSL Actually Encrypts a Connection
When a browser connects to an HTTPS site, it and the server perform what's called a TLS handshake: the server presents its certificate, the browser verifies it against a trusted certificate authority's records, and the two sides agree on an encryption key used only for that session. Everything sent afterward — form data, cookies, page content — is scrambled using that key, so anyone intercepting the raw traffic sees only encrypted noise rather than readable data.
This happens in a fraction of a second and requires nothing from the visitor, but it depends entirely on the server having a valid, correctly installed certificate. An expired certificate, a mismatched domain name, or a certificate signed by an untrusted authority all trigger warning screens that most visitors will not click through, which is why keeping a certificate current matters as much as installing one in the first place.
What the Padlock and HTTPS Actually Confirm
The padlock icon confirms two things and only two things: the connection to that specific domain is encrypted, and the certificate presented was issued by a certificate authority the browser trusts. It does not mean the site's content is trustworthy, safe, or legitimate — a scam site can have a valid SSL certificate just as easily as a legitimate one, since basic certificates only verify domain ownership, not business practices.
That's a common misunderstanding worth correcting: SSL is about the safety of the connection, not a review of the destination. It stops a third party from reading or tampering with data in transit; it says nothing about what the site itself will do with that data once it arrives.
DV, OV, and EV: The Three Verification Levels
Domain Validated (DV) certificates are the fastest and most common to obtain — the certificate authority only confirms the applicant controls the domain, usually via an automated DNS or email check, and issuance can take minutes. This is what most free certificates, including auto-renewing ones bundled with hosting, provide, and it's entirely sufficient for the vast majority of websites, blogs, and small business sites.
Organization Validated (OV) certificates require the certificate authority to verify the requesting organization actually exists as a registered business, which takes longer and typically costs more, and is chosen by companies that want that verification available in the certificate details. Extended Validation (EV) certificates go further still, requiring documented proof of legal, physical, and operational existence of the business before issuance — historically shown with a green company name in the browser bar, though most browsers have since simplified how EV certificates are visually distinguished. EV remains most common on banking and payment sites where the extra verification carries real weight.
Why Every Site Needs SSL Now, Not Just Stores
It used to be common advice that only sites handling payments needed SSL. That's no longer accurate for three converging reasons: search engines factor HTTPS into rankings, so an unencrypted site is at a structural disadvantage before content is even considered; browsers actively flag HTTP-only sites as 'Not Secure' in the address bar, which visibly damages trust on contact forms, login pages, and comment sections, not just checkouts; and any page with a login form, contact form, or even a simple newsletter signup is transmitting data worth protecting.
The good news is that obtaining a basic DV certificate is no longer a cost or technical barrier. Hosting Cheap includes free, auto-renewing SSL on every plan, so there's no certificate to purchase, no manual renewal to forget, and no gap in coverage that leaves a site briefly showing as insecure.
SSL Shouldn't Be an Extra Step
A certificate that has to be manually renewed is a certificate that will eventually expire on the wrong day, usually right when traffic is highest. That's the exact failure mode free auto-renewing SSL is designed to eliminate.
Every Hosting Cheap plan issues and renews SSL automatically across every domain on the account, so HTTPS just stays on, without a support ticket or a calendar reminder.
- Free SSL certificate issued automatically for every domain
- Auto-renewal means no certificate ever lapses unnoticed
- DV-level encryption is sufficient for the vast majority of sites
- 24/7 support if you need help enforcing HTTPS site-wide
Why Hosting Cheap
What you get
Free auto-renewing SSL
Every domain gets a certificate at no cost, renewed automatically before it expires.
No manual certificate management
No CSR generation or renewal reminders needed for standard DV coverage.
Better search visibility
HTTPS is a ranking signal, so encrypted sites start with an advantage unencrypted ones don't have.
Visitor trust from the padlock
Forms and login pages display the secure padlock visitors now expect by default.
24/7 human support
Get help with certificate installation, mixed-content fixes, or upgrading to OV/EV if needed.
30-day money-back guarantee
Try HTTPS-secured hosting risk-free and confirm it works exactly as expected.
How It Works
Get set up in a few steps
Confirm your certificate type
Check whether you need basic DV coverage or a business-verified OV or EV certificate.
Let SSL issue automatically
On Hosting Cheap, a free certificate is issued and applied to your domain without manual setup.
Enforce HTTPS site-wide
Update internal links and redirects so every visitor lands on the encrypted version of your site.
Included
Everything you need, on every plan
- Certificate installed and showing a valid padlock in the browser
- Certificate covers the correct domain and any subdomains in use
- Auto-renewal enabled so the certificate never lapses
- HTTP traffic redirected to HTTPS site-wide
- Mixed-content warnings resolved (no HTTP images or scripts on HTTPS pages)
- DV, OV, or EV level matched to the site's actual needs
- Certificate authority is one recognized by all major browsers
FAQ
Frequently asked questions
What is an SSL certificate in simple terms?
It's a file installed on a server that encrypts data traveling between a visitor's browser and that server, while also verifying the site's identity to some degree, depending on whether it's DV, OV, or EV level.
Do I need a paid SSL certificate or is free enough?
For most websites, a free DV certificate provides the same encryption strength as a paid one. Paid OV or EV certificates add verified business identity information, which matters most for financial institutions or sites where that extra trust signal has measurable value.
What's the difference between SSL and TLS?
TLS is the modern, more secure protocol that replaced the older SSL protocol years ago, but 'SSL certificate' remains the common term people use even though the certificates issued today actually run on TLS.
Does SSL make my site completely safe from hackers?
No. SSL encrypts the connection between browser and server, protecting data in transit, but it does not protect against vulnerabilities in the site's code, weak passwords, or malware — those require separate security measures.
Why does my browser say a site is 'Not Secure' even though it loads fine?
That warning means the site doesn't have an SSL certificate active, so the connection is unencrypted HTTP rather than HTTPS. The site can still load and function, but any data submitted through it travels unencrypted.
Is SSL free with Hosting Cheap?
Yes, every plan includes a free, auto-renewing SSL certificate applied to your domain, so there's no separate purchase or manual renewal required.
Get Free SSL on Every Domain
Every Hosting Cheap plan includes auto-renewing SSL, so HTTPS is on from day one, from $2.09/mo.
Get Started