Introduction
Yes, you can get a free SSL certificate for your small business website, and it takes about 15 minutes. Most UK web hosts include one at no extra cost. If yours does not, Let’s Encrypt issues free certificates that encrypt your site in exactly the same way as a paid one. This guide shows you how to check your host first, install the certificate, and fix the common problems that follow.
What an SSL certificate actually does
An SSL certificate encrypts the connection between your website and your visitors. When it is active, your address starts with https and browsers show a padlock. Anything a visitor types into a form, from a contact enquiry to a card payment, travels scrambled so it cannot be read if it is intercepted.
That padlock also matters for trust. Browsers now mark sites without a certificate as “Not secure”. Visitors notice that warning, and many leave. Google has used HTTPS as a ranking signal for years, so a site without a certificate can also rank lower than a competitor with one.
There is one thing a certificate does not do. It does not prove your business is honest, and it does not stop phishing. A scam site can have a valid certificate too. The padlock means the connection is encrypted. It says nothing about who runs the site. That is why the certificate is only one layer of security, and why spotting fake messages still matters. Our guide on how to spot a phishing email explains the red flags with UK examples, including fake HMRC refunds and supplier bank detail scams.
Step 1: check your host first
Before you install anything, check whether your host already includes a free certificate. Most UK hosts do. Hostinger, SiteGround, 20i and many others include a free Let’s Encrypt certificate with every hosting plan, and they install and renew it for you. If your site runs on one of these hosts, your certificate may already be active, or it may be one click away.
Log in to your hosting control panel. On Hostinger, open hPanel and look under Domains, then SSL. On cPanel, look for SSL/TLS Status or the Let’s Encrypt option. On Plesk, look under Websites and Domains, then SSL/TLS Certificates. If a certificate is listed as active, check that your site actually loads over https. Type your address with https in front of it and see whether the padlock appears.
If no certificate is listed, look for a button that says Install, Activate or Get Free SSL. Most panels issue the certificate within minutes. Some hosts only issue it once your domain points at their nameservers, so if you recently moved hosts, check that your DNS has finished updating first. If your domain still points at your old host, the new host cannot prove you control it, and the certificate will fail.
If your host charges for SSL, or the free option is buried, do not pay yet. Read the next section first. You can often get the same protection for nothing.
Step 2: get a free certificate from Let’s Encrypt
Let’s Encrypt is a non profit certificate authority. It issues free Domain Validation certificates, and it is trusted by every major browser. The certificate it issues encrypts your site in exactly the same way as a paid Domain Validation certificate. There is no difference in the padlock your visitors see.
A Let’s Encrypt certificate lasts 90 days. That sounds short, but it is deliberate. The short life forces renewal to be automatic, so certificates never quietly expire. Most hosts renew them for you in the background, and you never have to think about it. If your host does not automate renewal, you will need a small tool or plugin that does. Do not install a certificate you have to renew by hand every three months. That is how expired certificates happen.
To install one yourself, you need access to your hosting panel or server. In cPanel, open SSL/TLS Status, select your domain, and choose Run AutoSSL, or use the Let’s Encrypt option if your host provides it. In Plesk, open SSL/TLS Certificates, choose Add, and select Let’s Encrypt. The panel will check that you control the domain, usually by placing a small file on your site or by checking DNS, and then issue the certificate.
If you run your own server, a developer can install a certificate using Certbot, the free tool Let’s Encrypt provides. It takes minutes on a standard server, and it sets up automatic renewal at the same time. If that sentence made you nervous, you do not run your own server. Stick to the hosting panel route.
Once the certificate is issued, force your whole site onto https. In WordPress, go to Settings, then General, and change both the WordPress Address and Site Address from http to https. Then check that your site still loads. If it does, the certificate is working.
Free versus paid: when paying makes sense
For most small business websites, a free certificate is all you need. A free Domain Validation certificate proves you control the domain, and it encrypts the connection. A paid Domain Validation certificate does the same job, and costs from around 8 pounds a year. Paying for the same level of validation buys you nothing extra in security.
There are two cases where paying is worth considering. The first is Organisation Validation. With this type, the certificate authority checks your registered company details before issuing the certificate. It proves a real business stands behind the site. That can matter if a partner, a supplier or a procurement process asks for proof of your company’s identity. Expect to pay from around 100 pounds a year.
The second case is a warranty. Some paid certificates come with a warranty, which is a promise from the certificate authority to pay compensation if the certificate is issued wrongly. Payment processors and insurers occasionally ask for one in writing. A free certificate carries no warranty.
There is also Extended Validation, the highest level. It involves the deepest checks on the business. Most small firms never need it. If nobody has asked you for Organisation or Extended Validation by name, a free certificate is the right choice. Spend the money on something that actually improves your site.
One change to know about: since 15 March 2026, the maximum lifespan of any SSL certificate has been 200 days, down from 398 days. That change only affects paid certificates with long lives. Let’s Encrypt certificates were already 90 days, so nothing changes for you.
Step 3: fix mixed content, the “not fully secure” warning
You install the certificate, the padlock appears on your homepage, and then you visit another page and see “Not fully secure” instead. That is mixed content. The page loads over https, but some part of it, usually an image, a script or a stylesheet, still loads over http. Browsers warn about it because that one insecure element weakens the whole page.
The fix is usually simple. In WordPress, the most common cause is old image links that still start with http. Search your site for image URLs that begin with http and update them to https. A plugin such as Better Search Replace can do this across the whole database in one pass, but back up first. If your theme or a plugin loads a script from an http address, update the plugin or theme, or replace the script with an https version.
After you fix the links, clear your cache and reload the page. If the warning is gone, you are done. If it persists, open your browser’s developer tools, press F12, and look at the Console tab. It lists each insecure element by address, so you can track down the last few stragglers one by one.
Do not ignore mixed content. A page with the warning looks unprofessional, and visitors may treat it the same way they treat a site with no certificate at all. The fix takes minutes, and it is part of finishing the job properly.
Step 4: set renewal to automatic and check it yearly
A certificate that expires is worse than no certificate at all. An expired certificate throws a full page browser warning that blocks visitors entirely. That is why automatic renewal matters more than the certificate itself.
If your host manages the certificate, renewal is already automatic. It will issue a new certificate well before the old one expires, every 90 days, for as long as your site is hosted there. You do not need to do anything, but you should still check once a year that it is working. Click the padlock in your browser, open the certificate details, and confirm the expiry date is in the future. If it shows a date in the past, your renewal has broken, and your host needs to know.
If you installed the certificate yourself, make sure the renewal tool is running. Certbot sets this up by default. Test it once with a dry run, and set a calendar reminder to check the certificate every few months. The day your certificate expires is a bad day to discover that renewal was never switched on.
How to check your certificate is working
There are three quick checks. First, open your site in a private browser window and confirm the padlock appears next to the address. Second, click the padlock and confirm the certificate is issued to your domain, not to someone else’s. Third, run your address through a free checker such as the SSL Labs test or Why No Padlock, which will list any remaining problems, including mixed content and weak settings.
Also check the www and non www versions of your site. A certificate usually covers both, but not always. If https works on example.com but fails on www.example.com, your certificate is missing the www name. Most hosts issue a wildcard certificate that covers every subdomain, which solves this. If yours does not, ask your host to reissue it with both names included.
Finally, check your contact forms and checkout pages. These are the pages where visitors hand over personal details, and they are the pages where a missing certificate does the most damage. The ICO’s guidance, updated in November 2025, expects organisations to use TLS encryption for online applications that handle personal data. A certificate is the baseline, not a nice extra, and handling customer data carefully is part of the same duty. Our guide on putting customer data into ChatGPT under UK GDPR covers what that duty means in practice for small firms.
FAQs
Is a free SSL certificate really safe? Yes. A free certificate from Let’s Encrypt provides exactly the same encryption as a paid Domain Validation certificate. It is issued by a trusted certificate authority, and every major browser accepts it. The only things it does not provide are a warranty and organisation level validation, and most small business sites need neither.
How long does a free SSL certificate last? A Let’s Encrypt certificate lasts 90 days. That is deliberate, so renewal stays automatic. Your host should renew it for you before it expires, and you should never have to do anything. If your host does not automate renewal, use a tool that does, or move to a host that includes it.
Do I need a separate certificate for each subdomain? Not usually. Most hosts issue a wildcard certificate, which covers your main domain and every subdomain under it, such as shop.example.com and blog.example.com. If your certificate does not cover a subdomain, your host can reissue it as a wildcard, usually at no extra cost.
Will a free certificate hurt my Google ranking? No. Google treats a free Let’s Encrypt certificate exactly the same as a paid one. What matters is that your site loads over https. A site with a free certificate ranks the same as a site with a paid certificate, and better than a site with no certificate at all.
My host charges for SSL. Should I pay or switch hosts? Try the free route first. If your host’s panel offers a free Let’s Encrypt option, use it. If your host only sells certificates and will not let you install a free one, that is a reason to consider switching hosts. Most UK hosts include a free certificate, so paying for one is rarely necessary for a small business site.
Conclusion
A free SSL certificate is one of the easiest wins in small business website security. Check your hosting panel first, because your host probably includes one already. If it does not, Let’s Encrypt issues a free certificate that does the same job as a paid one. Install it, force your site onto https, fix any mixed content, and make sure renewal is automatic. Then move on to the next layer of security. A certificate protects the connection, but your passwords and your team’s habits protect everything behind it. Our guide on the best password managers for small teams shows how to fix the shared password problem in a week, so the certificate is not the only thing standing between your business and an attacker.
