The padlock in the address bar is backed by a certificate. Here is what it is, whether it needs paying for, and the two places it goes wrong.
What it actually protects
HTTPS does two things:
Encryption. Data between visitor and server is encrypted, so whoever sits in between — the operator of a public wifi network, for instance — cannot read it. Essential for any site with logins, forms or payments.
Identity. The certificate proves the domain is genuinely under your control and the visitor is not talking to an impostor.
What it does not protect: your website’s software. HTTPS secures transport, not content. A vulnerable site with HTTPS is still compromised — the compromise is merely encrypted.
That misunderstanding is widespread. “We have HTTPS, so the site is secure” is half true.
Does it cost money
For nearly every website, no.
Let’s Encrypt issues free certificates automatically and renews them automatically, with encryption identical to paid ones. Most hosts and CDNs integrate it and enable it with a click.
Paid certificates differ in two respects: types carrying organisational validation, which display a company name, suited to banks and large retailers needing extra assurance; and warranty cover. Neither applies to an ordinary business website.
If someone proposes a certificate at a few hundred a year, ask why. Usually the money can stay where it is.
Where it goes wrong most: expiry
Free certificates typically last 90 days and depend on automatic renewal. The short life is deliberate — it forces automation.
The catch is that automatic renewal can itself break, and when it does nobody is informed. Common causes: the renewal service stopped, a configuration change invalidated the renewal script, the domain validation method changed, or the scheduled task running it was removed by accident.
The consequence is dramatic. The moment it expires, every visitor sees a red security warning instead of your website, and most people close that page immediately.
You may not know for a day, because your own browser may have cached the previous state, or because you had no reason to visit your own site.
Prevention:
Set up expiry monitoring. Free services will email you 30 days before a certificate expires. Five minutes of setup against one whole-site outage.
If someone maintains your site, ask three questions: is renewal automatic, when did it last renew, and is there an expiry alert? The answers are revealing.
The other trap: secure-looking without encryption
Subtler, and easy to hit when using a CDN.
The path to your site has two legs: visitor to CDN, and CDN to your server. They are configured separately.
A mode called Flexible encrypts the first leg and not the second. The browser shows a padlock and the user believes the connection is protected, while data travels unencrypted between the CDN and your server.
This is worse than having no HTTPS, because it manufactures false confidence. Seeing the padlock, people submit forms and type passwords.
The correct setting is Full (strict): both legs encrypted, with your server’s certificate validated. As long as your server has a certificate — free, so there is no reason not to — this is the setting to use.
To check, look at the SSL mode in your CDN dashboard. If it says Flexible, change it to Full (strict), having first confirmed a valid certificate exists on the server, or the site will stop loading.
Mixed content
The site is HTTPS overall, but an image, script or stylesheet is referenced with an http:// address.
Browsers block those resources or warn about them, which appears as missing images, broken layout or a feature that stops working — and only in some browsers, making it hard to reproduce.
To check: the developer tools console reports mixed content explicitly. Or search the page source for http://.
This appears most often after migrating from http to https, when older content still contains old image addresses. A bulk replacement fixes it, remembering that database content needs replacing too, not just template files.
Four things to do
As a checklist:
1. Install a free certificate. There is no remaining reason to serve a site over http.
2. Confirm http redirects to https. Otherwise both versions exist and search engines treat them as two sites, splitting authority.
3. Set the CDN’s SSL mode to Full (strict). Not Flexible.
4. Set an expiry alert. The only thing standing between you and a morning where the entire site is a warning page.
On the projects we host, certificates renew automatically and expiry is monitored. Not a premium feature — baseline configuration, because failure here takes the whole site down rather than degrading one function.