Website · 10 min read · Updated:
What is an SSL certificate? A guide to website security and moving to HTTPS
A “Not secure” warning in the address bar is reason enough for a visitor to leave your site. SSL fixes it, but website security is about more than a certificate.
In short
- An SSL certificate is a digital document that encrypts the connection between the visitor's browser and the website and confirms the site belongs to that domain; the protocol in use today is called TLS.
- HTTPS is an HTTP connection encrypted with SSL/TLS; browsers show a “Not secure” warning on pages without HTTPS.
- A domain-validated (DV) certificate is enough for small business sites; what really matters is that it renews on time, automatically.
- Website security needs, besides HTTPS, strong passwords and two-step verification, limited permissions, form protection and regular backups.
- In Heyşirket, SSL certificates for your subdomain and your own connected domain are set up and renewed automatically at no extra cost.
A customer visits your site and sees “Not secure” in the address bar. They think twice before typing their phone number into your contact form, and often just close the tab. Yet the problem isn't a big one: the site isn't served over HTTPS.
In this article we explain in plain words what an SSL certificate is, how HTTP and HTTPS differ, how to move to HTTPS and which certificate type is enough for you. Then we go beyond the certificate and list what a small business should check for website security.
Part 1 · Definition What is an SSL certificate?
An SSL certificate is a digital document that verifies a website's identity and is used to encrypt the connection between the visitor and the site. It's issued by a trusted certificate authority. When the browser connects, it checks the certificate; if it's valid, the connection is encrypted.
Although the name SSL has stuck, the protocol used today is TLS. Old SSL versions were retired years ago because of security flaws. “SSL certificate” really means the certificate used for TLS.
What does encryption do? When a visitor types their name, phone or a message into your form, that information passes through many points on the internet. Without encryption, someone in between, for example on an open café network, could read it or change the page's content. HTTPS prevents this.
Part 2 · Difference What is the difference between HTTP and HTTPS?
| HTTP | HTTPS | |
|---|---|---|
| Connection | Unencrypted, plain text | Encrypted with TLS |
| In the browser | “Not secure” warning | No warning, certificate in the connection details |
| Form data | Readable in transit | Not readable in transit |
| Search engines | Google counts HTTPS as part of page experience | The preferred version |
| Modern features | Many browser features such as location and camera don't work | They work |
Google counts HTTPS as one of its page experience signals. It won't move you to the top on its own, but a site still on HTTP starts behind on both trust and visibility. HTTPS also matters for speed: browsers use modern, faster connection protocols only over HTTPS. We explain how to measure your site's speed in how to measure site speed.
Part 3 · Types Types of SSL certificate: which one is enough?
| Type | What it verifies | Who it's for |
|---|---|---|
| DV (domain validated) | That the requester controls the domain | Small businesses, company sites, blogs, most shops |
| OV (organisation validated) | The organisation's existence, in addition to the domain | Those who want organisation details in the certificate |
| EV (extended validation) | A detailed official check of the organisation | Banks and large organisations handling high-risk transactions |
Encryption strength is the same for all three; the only difference is how deeply identity is checked. Browsers no longer show a clear difference between the types in the address bar. For a small business site a DV certificate is enough and is usually free. Certificates also differ by coverage: a single domain, a domain together with www, or a wildcard covering all subdomains.
Part 4 · Migration How to move to HTTPS: the steps
If your site still opens over HTTP, or you're moving from another platform, the switch goes in this order:
Moving from HTTP to HTTPS
Install the certificate
Turn on the free, automatically renewing certificate your hosting platform offers. Make sure it covers both the root domain and the www version.
Redirect all traffic to HTTPS
Send HTTP addresses to their HTTPS counterparts with a permanent 301 redirect. Make only one of the root and www versions the main address, and redirect the other to it.
Clean up mixed content
Even on an HTTPS page, if an image, script or font loads over http://, the browser blocks it or shows a warning. Change addresses in your content and custom code to https://.
Add HSTS
The HSTS header tells the browser to open the site only over HTTPS for a period of time. That way, even if someone clicks an old HTTP link, no unencrypted connection is made.
Update Search Console
Make sure the HTTPS version is verified in Search Console and that the sitemap lists HTTPS addresses. Switch internal links to HTTPS too.
Part 5 · Security Website security: beyond the certificate
HTTPS protects the connection, but if someone logs into your site's admin panel with your password, the certificate doesn't help. On small business sites most problems come from weak passwords, shared accounts and missing backups.
Website security checklist
- The site opens over HTTPS with no “Not secure” warning.
- The certificate renews automatically; I don't need to track its expiry date.
- No images or scripts load over http:// on my pages.
- Everyone who logs into the admin panel has their own account; passwords aren't shared.
- Two-step verification is on for all administrators.
- Everyone has only the permissions their job needs; leavers' accounts are closed.
- Contact and quote forms are protected against bot submissions.
- Backups are taken regularly and I know how to restore one.
- The email address on my domain and hosting accounts is current and mine.
Part 6 · Troubleshooting I'm getting an SSL error. What should I do?
Certificate problems usually come from a few familiar causes. The warning text in the browser tells you which one it is.
| Symptom | Likely cause | What to do |
|---|---|---|
| Full-page “Your connection is not private” warning | The certificate has expired or was never installed | Renew it and switch to automatic renewal |
| Warning that the certificate belongs to another name | The certificate doesn't cover www or the root domain | Install a certificate covering both versions |
| The page opens but shows “Not secure” | Content on the page loads over http:// | Change mixed content to https:// |
| Warning on a newly connected domain | The DNS record hasn't propagated yet, the certificate is being prepared | Check the records; waiting is usually enough |
| Warning on one computer only | The device clock is wrong or software on the network is intercepting | Fix the clock, try another network |
If you've just connected the domain, be patient: DNS records can take from a few minutes to a few hours to propagate. To make sure the records are entered correctly, see our provider-specific guides such as connecting a domain on Cloudflare.
Part 7 · Product SSL and site security in Heyşirket
In Heyşirket you don't need to buy or install anything for SSL. Your free examplefirm.heysirket.com address opens over HTTPS from day one. When you connect your own domain, the certificate is installed automatically once your domain's CNAME record points to us and verification is complete, and it renews automatically before it expires. We explain the connection steps in connecting your own domain, and you see what each status means on the Ayarlar › Alan adları (Settings › Domains) screen in the panel.
- Encryption: Connected domains use at least TLS 1.2; the www address redirects to the root address.
- Security headers: Site pages are served with HSTS, a content security policy (CSP) and headers that restrict browser permissions.
- Infrastructure: Sites are served over Cloudflare's global network.
- Form protection: Connect Turnstile on the Entegrasyonlar (Integrations) screen to protect your forms against bot submissions.
- Account security: On the Güvenlik ve oturumlar (Security and sessions) screen you turn on two-step verification, get your backup codes and close sessions you don't recognise. You give your team administrator, editor or author roles.
- Backup: Download a full backup of your site from Ayarlar › Araçlar › Dışa aktar (Settings › Tools › Export).
The SEO › Site denetimi (Site audit) in the Professional plan also finds insecure resources loaded over http:// on your pages and shows how to fix them. For the team and permissions side, see team permissions and data security. Step-by-step in the panel: Help › Connecting a domain.
What is an SSL certificate?
An SSL certificate is a digital document that confirms a website belongs to its domain and encrypts the connection between the visitor and the site. The protocol in use today is TLS, but the certificate is still commonly called an SSL certificate.
How do you enable HTTPS?
First a certificate that renews automatically is installed for your domain, then all HTTP addresses are redirected to HTTPS with a 301. Resources loaded over http:// on your pages are fixed, HSTS is added, and Search Console and the sitemap are updated with HTTPS addresses.
Is a free SSL certificate secure?
Yes. Free domain-validated (DV) certificates give the same encryption strength as paid ones. The only difference is how deeply identity is checked, and a DV certificate is enough for small business sites.
Why does the “Not secure” warning appear?
The browser shows it when the page opens over HTTP instead of HTTPS, when the certificate has expired or when it belongs to another domain. Content loaded over http:// on an HTTPS page can also trigger a warning.
Is the SSL certificate paid in Heyşirket?
No. Your free subdomain opens over HTTPS, and the certificate for your own connected domain is installed and renewed automatically after verification. You don't need to buy a certificate or renew it by hand.
Connect your domain securely Add your domain and enter the records; verification and the SSL certificate complete automatically. Open domains
Author: Heyşirket Editorial Team