SSL Certificate

An SSL certificate is a digital file that you install on a web server to encrypt the connection between the browser and the website. The abbreviation stands for Secure Sockets Layer, although the current standard is TLS (Transport Layer Security). Once an SSL certificate is active, the padlock icon appears in the address bar and the URL begins with https:// instead of http://. For small and medium-sized businesses with an ecommerce store, contact form, or customer portal, an SSL certificate is required under the GDPR and is crucial for building trust and improving discoverability.

How an SSL certificate works in practice

When someone visits your website, the server sends the SSL certificate to the browser. The browser checks that the certificate is valid and issued by a recognized Certificate Authority such as Let's Encrypt, DigiCert or Sectigo. Then browser and server exchange encrypted keys. All data going back and forth after this, from login credentials to payment information, is sent encrypted. This means that a third party eavesdropping on the connection sees only unreadable code. For the visitor, this happens within fractions of a second, with no visible delay. The technical term for this process is the TLS handshake. In practice, we see with SME customers that the installation of an SSL certificate is usually arranged within an hour via the hosting environment.

Why SSL came into being and why it is now mandatory

SSL was developed in the 1990s as ecommerce emerged and confidential data was being sent over the Internet. The original SSL protocol has since been replaced by TLS, but the term SSL certificate has stuck. As of 2018, browsers such as Chrome and Firefox mark all sites without SSL as "not secure," deterring visitors. Google also uses HTTPS as a ranking factor: sites without an SSL certificate score lower in search results. For ecommerce stores and sites that process personal data, an SSL certificate is required by law under the AVG. Without SSL, you risk fines, loss of customer confidence and lower conversion.

What an SSL certificate brings to your business

An SSL certificate ensures that visitors see the lock in the address bar and do not receive a warning. This increases trust and lowers the bounce rate, especially on first visits. For ecommerce stores, the difference is measurable: sites with HTTPS convert better on average because customers feel safer entering payment information. In addition, an SSL certificate offers SEO benefits. Google rewards secure sites with a slight boost in ranking. With managed WordPress hosting from Monkey Vision, an SSL certificate is included by default and automatically renewed, so you don't have to arrange manual renewals. For companies running customer portals or login environments, SSL is also technically necessary: modern browsers block unencrypted forms or show explicit warnings. This makes an SSL certificate not a luxury but basic infrastructure for any professional website.

An SSL certificate is broadly applicable, from simple information sites to complex Web applications. The choice of certificate type and configuration depends on what your site does and how many domains or subdomains you are securing. Below are the most common applications in SME contexts, with practical considerations for each scenario.

Securing ecommerce stores and payment pages.

For ecommerce stores, an SSL certificate is legally required and technically indispensable. Payment providers such as Mollie, Adyen and Stripe require a secure connection before processing payments. Without SSL, these services simply refuse the connection. Visitors to an unsecured checkout page see a red warning in the browser, costing direct sales opportunities. An ecommerce store with 500 products and an average of 200 visitors per day can suffer 30 to 40 percent conversion loss due to the lack of SSL. In ecommerce store development, we install an SSL certificate by default and test the entire checkout flow for security warnings. For ecommerce stores with multiple subdomains, for example shop.example.co.uk and api.example.co.uk, a wildcard certificate is more efficient than separate certificates per domain.

Contact forms and lead generation pages

Any page where visitors enter personal data, from a simple contact form to a quote request, falls under the AVG. That means you are required to send that data encrypted. Browsers such as Chrome show a "Not Secure" warning in the address bar for unsecured forms, which directly affects the completion rate. In practice, we see with SME clients that landing pages for Google Ads without SSL yield 20 to 30 percent fewer leads, purely due to the lack of trust. An SSL certificate solves this without having to change the design or technology of the form. For companies running multiple landing pages or campaigns, it is wise to include SSL directly with SEO optimization so that all pages are secure from launch.

Client portals, login environments and API links

For companies with a customer portal, dashboard or API links to external systems, SSL is technically mandatory. Modern browsers block unencrypted cookies and session data, which means that logging in without SSL simply does not work. Even APIs that exchange data between systems, for example between your CRM and your website, require a secure connection. A B2B service provider with 50 customers who view invoices and project status via a portal runs the risk of sensitive company data being intercepted without SSL. For API links, we recommend a certificate with Extended Validation (EV) if you're working with financial or medical data, as it provides additional authentication. For regular customer portals, a Domain Validation (DV) certificate suffices, provided authentication is properly set up with two-factor authentication and secure password requirements.

When an SSL certificate is the right choice and when it is not

An SSL certificate is always the right choice once your site goes live, regardless of whether you are collecting data. Google ranks HTTPS sites higher and visitors expect the lock in the address bar. There are no realistic scenarios in which it is better to omit an SSL certificate. However, the type of certificate does vary: for a simple corporate site with only information, a free Let's Encrypt certificate is sufficient. For ecommerce stores or customer portals with high transaction volumes, a paid certificate with guarantee and more extensive validation is wiser. A wildcard certificate makes sense if you are securing multiple subdomains, but overkill for a single domain. Note that an SSL certificate only secures the connection, not the server itself. Additional backups and firewalls remain necessary for complete security.