HTTPS AND SSL · 2026
What is HTTPS? The padlock your customers look for
What HTTPS is, how it differs from HTTP, what SSL and a certificate are, what the padlock proves and what it doesn't, why a small business website needs it, and how to get it — in plain words, with Google's and Chrome's own statements as the sources.
Free to build · Pay when you publish · No credit card
The short answer
HTTPS is the secure version of the connection between a visitor's browser and your website: everything sent between them is scrambled so nobody in between can read or change it. The padlock — or in Chrome, a small settings icon since 2023 — means it's on; a site without it is labeled "Not secure".
HTTP is the language a browser and a website use to talk to each other; the S stands for secure. On a plain HTTP connection, anything a visitor types into your site — a quote request, a phone number, a card number — travels as readable text that anyone on the same Wi-Fi or in between can read. On HTTPS it's scrambled on the way and only your site can unscramble it. Today it's the default for the web, it costs nothing, and on most website builders it's done for you.
The address itself is a separate subject: what a domain name is, and .com vs .net vs .org: which ending to pick.
The padlock, included
See your website — the padlock comes with it
Add what you do, your town and your business name, and Zarla builds the site from that one line. Build and preview free; when you publish on a paid plan, HTTPS is set up for you on your Zarla address and on your own domain.
Already have a website? Bring it across →Zarla keeps your old page addresses where it can and redirects the ones that change, helping you keep the Google standing you've built.
HTTP VS HTTPS
HTTP vs HTTPS, side by side
The same website on each kind of connection, from the visitor's side.
| HTTP | HTTPS | |
|---|---|---|
| What the address starts with | http:// | https:// — and a padlock in most browsers |
| What a visitor's browser shows | "Not secure" next to the address in Chrome, on every page | A padlock in Safari and Firefox; in Chrome, a small settings icon since September 2023, with a warning only when something is wrong |
| What happens to a filled-in form | Travels as readable text; anyone between the visitor and your site can read or change it | Scrambled on the way; only your site can read it |
| Proof of who the site is | None | A certificate, checked by the browser, that the site really is at that domain |
| A lightweight ranking signal against you since 2014 | The signal is in your favor — small, but real | |
| Cost today | — | Included with most website builders and hosts; free certificates exist for everyone else |
Chrome's "Not secure" label: the Chromium blog, February 2018. The ranking signal: Google Search Central, August 2014. Both are linked under "Where these facts come from".
What SSL is — and SSL vs TLS vs HTTPS
Three names for the same job, which is why the question gets asked. SSL (Secure Sockets Layer) was the original technology that scrambled the connection, in the 1990s. TLS (Transport Layer Security) replaced it years ago and is what every site uses now, but the old name stuck, so people still say "SSL certificate". HTTPS is what you get when a website uses TLS: the secure version of the connection, shown by the padlock.
The certificate is the site's ID card. It's a small file, issued by a certificate authority the browsers trust, that says "this certificate belongs to yourbusiness.com". When a visitor opens your site, their browser checks the certificate, confirms it matches the domain and hasn't expired, and only then sets up the scrambled connection. If the check fails — the certificate expired, or it was issued for a different name — the browser shows a full-page warning instead of your site. That's the failure owners actually see: a certificate that lapsed because nobody renewed it.
Certificates used to cost money every year. Now Let's Encrypt, a nonprofit certificate authority, issues them free to anyone who controls a domain, and website builders and hosts issue and renew them automatically. Paying for a basic certificate in 2026 is paying for something the platform should be doing for you.
What the padlock proves — and what it doesn't
A word on the icon first: Chrome replaced the padlock with a small settings icon in September 2023, because people read the lock as "this site is trustworthy" when it only ever meant "this connection is encrypted" (the Chromium blog, May 2023). Safari and Firefox still show a lock. Whatever the icon, the meaning is the same.
Worth being precise, because the padlock is often oversold. It proves two things: that the connection between the visitor and the site is encrypted, and that the site really is at the domain in the address bar. It does not prove the business behind the site is honest, that the site is free of malware, or that your details are safe once they arrive. A scam site can get a certificate in minutes — it only has to control its own domain — so the padlock on its own doesn't make a site safe to buy from.
What that means for a business owner: HTTPS is the floor, not the ceiling. Not having it marks you out — Chrome tells every visitor your site is "Not secure" — but having it is simply what a legitimate site looks like. The things that earn trust sit on top: a real address and phone number, reviews, photos of actual work, and a form that goes somewhere.
Why a small business website needs HTTPS
- Chrome labels HTTP sites "Not secure". Since Chrome 68 in July 2018, every page on a plain HTTP site carries the warning in the address bar (the Chromium blog, February 2018). A customer who sees "Not secure" next to your business name doesn't read on to find out it's only a brochure site.
- Your forms carry customer details. A quote request has a name, an address and a phone number in it; a booking has a card. On HTTP they cross the internet as readable text. In the US, and in most countries, you're expected to handle customer details with reasonable care — check your local rules for what applies to you — and an unencrypted form is the easiest thing to be caught out on, and the cheapest to fix.
- Google counts it. HTTPS has been a ranking signal since 2014 — Google called it lightweight and said it affected fewer than 1% of searches when it launched (Google Search Central, August 2014) — so it won't lift you on its own, but it's one of the few signals that costs nothing.
- Everyone else has it. 90.4% of websites now default to HTTPS (W3Techs, read October 2026). A site without it looks abandoned, not old-fashioned.
- Some things don't work without it. Browsers refuse to give a plain HTTP page a visitor's location, camera or saved card details, and some modern features — a one-tap call button that shows a map, a booking widget — depend on those.
STEP BY STEP
How to get HTTPS on your website
For most small businesses this is already done; here is how to check, and what to do if it isn't.
Open your site and look at the address bar
Type your domain into a browser. A padlock — or in Chrome, the settings icon and no warning — beside the address means HTTPS is on. "Not secure" means it isn't, or the site is also being served on http://.
On a website builder, turn it on — usually it already is
Builders issue and renew the certificate for the addresses they serve. Zarla does it on your Zarla address and on a domain you buy or connect; Wix, Squarespace and GoDaddy's builder include one too. If a builder asks you to pay for a basic certificate, that's unusual today.
On a hosting account, install a free certificate
Most hosts have a one-click Let's Encrypt option in the control panel that issues and renews the certificate. If yours doesn't, the certificate can be issued free and installed by whoever looks after the site.
Connect the domain fully
A certificate can only be issued for a domain that points at the site. If you've just connected a domain and see "Not secure", the records usually haven't reached everyone yet — give it up to 48 hours, and check that no old forwarding or parking record is still in the way.
Send http:// to https://, and fix mixed content
The http:// version of your site should redirect to https:// (builders do this for you). Then look for any image or script still loaded over http:// — the browser calls it mixed content and drops the padlock for it. Re-upload the image, or change the link to https://.
HTTPS on a Zarla site
When you publish on a paid plan, the certificate comes with it: Zarla sets up HTTPS on your Zarla address and on a domain you buy or connect, and renews it, with nothing for you to install. Published Zarla sites run on Google Cloud, and the certificates are issued and renewed by Google's certificate service — the one bought-in part of the padlock is the part Google runs. A domain you buy through Zarla is secured as part of the setup; a domain you connect gets its certificate as soon as the connection check passes, which usually takes minutes once the records have spread.
If your connected domain still says "Not secure" after a day, the records usually haven't reached everyone, or an old forwarding record at the registrar is still answering for the domain: my domain isn't connecting shows how to tell which, and support will walk through the settings with you.
Most hosts and builders include a certificate now, so this isn't a reason to pick one platform over another; it's a box to check that it's on, and that nobody's charging you separately for it.
HTTPS and SSL: common questions
HTTPS is the secure version of HTTP, the way a browser and a website exchange pages and form entries. It's used so that what passes between a visitor and the site — a quote request, a password, a card number — is scrambled in transit and can't be read or altered on the way, and so the browser can confirm the site really is at the domain shown. Browsers mark sites without it "Not secure", which is why nearly every site uses it now.
HTTP sends everything between the browser and the site as readable text; HTTPS sends the same thing scrambled, using a certificate that also proves the site's identity. From the visitor's side the difference is https:// and a padlock instead of http:// and a "Not secure" label. From yours, HTTPS is the one your forms should be on, and on a website builder it's set up for you.
It means the connection is private and the site is really at that address — not that the business is honest or the site is free of malware. Any site can get a certificate for a domain it controls, scam sites included. Treat the padlock as the minimum a real site should have; judge the business by its address, phone number, reviews and work, not by the lock.
On, always, for every page — not only the pages with forms. There's no speed or cost reason to leave it off any more, Chrome labels pages without it "Not secure", and Google counts it as a small ranking signal. If your site has a setting for it, switch it on and make sure http:// addresses redirect to https://.
Fewer every year: about 90.4% of websites now default to HTTPS (W3Techs, October 2026), and the rest are mostly old or abandoned sites. Browsers now try the https:// address first. A business site on plain HTTP in 2026 isn't old-fashioned; to a visitor it looks broken.
Because everything on it is readable by anyone between the visitor and the site — the coffee shop's Wi-Fi, the visitor's internet provider, or someone who has got in the middle — and can be changed on the way without either side knowing. A quote form on HTTP hands over a customer's name, address and phone number in plain text. HTTPS closes both gaps: it scrambles the data and proves the site is the one it claims to be.
The file that makes HTTPS work: issued by a certificate authority the browsers trust, it states which domain it belongs to, and the browser checks it before setting up the secure connection. "SSL" is the old name for the technology — it's TLS now — but the term stuck. Certificates expire and must be renewed, which a website builder or host does automatically; an expired certificate is what produces the full-page browser warning.
Almost certainly not. Website builders and most hosts include a certificate and renew it for you, and free certificates from Let's Encrypt cover everyone else. Paid certificates exist for large companies that want extra identity checks; a local business gets no visible benefit from one. With Zarla, when you publish on a paid plan the certificate is set up and renewed for you on the address that comes with the plan and on your own domain — nothing to buy and nothing to install.
Where these facts come from
Every outside statement on this page is read off a published source, listed with the date we read it. Related: what a domain name is, .com vs .net vs .org: which ending to pick and website hosting for small businesses.
- Chromium Blog — A secure web is here to stay — dated February 2018, read October 2026
- Chromium Blog — An update on the lock icon (replaced by the tune icon in Chrome 117, September 2023) — dated May 2023, read October 2026
- Google Search Central Blog — HTTPS as a ranking signal — dated August 2014, read October 2026
- W3Techs — Usage statistics of default protocol HTTPS for websites — no date on the page, read October 2026
- Let's Encrypt — About — no date on the page, read October 2026
A secure website, with nothing to install
Describe your business in one line and Zarla builds the whole site. Publish on a paid plan and the certificate, the renewals and the padlock are handled for you — on the Zarla address and on a domain you buy or connect.
Already have a website? Bring it across →Zarla keeps your old page addresses where it can and redirects the ones that change, helping you keep the Google standing you've built.