You’ve seen it a thousand times: the small padlock next to a website’s address. Sometimes it’s there, sometimes your browser warns you the site is “Not secure”. That padlock is an SSL certificate doing its job — and on a hosting site, it matters more than almost anything else.
An SSL certificate is a small data file on a web server that does two things: it encrypts the connection between a visitor and the website, and it proves the website is really the one it claims to be. The padlock you see in the browser is the visible sign that both are in place.
The quick version
SSL (its modern name is TLS, but everyone still says SSL) is the technology behind the little padlock and the https:// at the start of a web address. With it, everything you type on a website — passwords, card numbers, contact forms — travels scrambled. Without it, that data crosses the internet in readable text.
Think of it like sending a letter. Without SSL, it’s a postcard: anyone handling it along the way can read it. With SSL, it’s a sealed envelope that only the recipient can open.
What the certificate actually does
An SSL certificate, installed on the hosting server, does two separate jobs:
1. Encryption. When your browser connects to a site, the certificate enables an encrypted channel. Even if someone intercepts the traffic — on public Wi-Fi, for example — all they see is unreadable ciphertext.
2. Identity. The certificate is issued by a Certificate Authority (CA) — a trusted organisation that verifies you control the domain before issuing. Browsers trust those CAs, so a valid certificate is a basic proof that the server really is yoursite.com and not an imitator.
Why Google ranks secure sites higher
Since 2014, HTTPS has been a ranking signal: all else equal, a secure site can outrank an identical insecure one. Since 2018, Chrome also marks every non-HTTPS site “Not secure” in the address bar — which visitors see before your content loads. In 2026, an SSL certificate isn’t an upgrade; it’s the entry ticket.
For a hosting business the stakes are higher still: your clients’ websites inherit your security posture. That’s why every AriHosting plan includes SSL by default — free, automatic, and renewing itself.
What visitors actually see
Valid certificate: a padlock, “https://”, and no warnings. Click the padlock and the browser confirms the connection is encrypted.
Expired or invalid certificate: a full-page warning — “Your connection is not private” — that most visitors won’t click through. An expired certificate on a business site costs real customers every day it stays broken.
No certificate at all: “Not secure” in the address bar, and browsers blocking form submissions on some pages.
Do you need to buy one?
Probably not. Domain-validated (DV) certificates — right for blogs, business sites, and most online shops — are issued free by Let’s Encrypt and included with essentially every modern hosting plan. They encrypt just as strongly as paid ones; the difference in paid certificates is extended validation and insurance levels, which matter mainly to large enterprises and banks.
What matters isn’t paying for SSL — it’s that the certificate installs, renews, and covers every page of your site automatically. That’s a hosting feature, not a shopping decision.
The one-minute checklist
- Padlock + https:// = SSL working. “Not secure” = broken or missing.
- SSL encrypts visitor data and proves your site is genuine.
- HTTPS is a Google ranking signal — and its absence scares visitors.
- Free DV certificates (Let’s Encrypt) are fully secure and standard with hosting.
- Renewals should be automatic — an expired certificate is worse than none.
Bottom line: every website needs SSL, every host should include it, and your visitors’ browsers decide in one glance whether your site is trustworthy. Every AriHosting plan ships with free automatic SSL →