Let me pop the hood on something that’s costing sites traffic every single day without a single complaint ever showing up in an inbox: no SSL certificate, no padlock, no trust.
Here’s what actually happens, moment by moment, from the instant a visitor lands on a site that’s still running on plain HTTP instead of HTTPS.
A visitor searches for exactly what your business does, clicks your listing, and instead of your homepage the browser throws up a plain, ugly warning: “Not Secure.” Most people don’t read past those two words. They hit back and click the next result instead.
What visitors actually see
Modern browsers check for a security certificate the instant a page starts loading. No certificate, and depending on the browser, an outright red or orange “Not Secure” label sits right in the address bar next to your web address, where every visitor’s eyes land first.
Most visitors don’t investigate. They don’t wonder if it’s a mistake or ask what SSL even means. They just leave, the same way you’d walk out of a store with the lights flickering and the door hanging half open. Nobody stops to ask why. They just leave.
Google is watching the same warning
Google has confirmed HTTPS factors into how it evaluates and ranks sites. That means a missing certificate isn’t just scaring off the visitors who do arrive, it’s quietly working against you in whether those visitors ever see your site in search results in the first place.
Two problems stacked on top of each other. Fewer people finding you, and fewer of the ones who do sticking around long enough to call.
The excuse that used to be true
For years, SSL certificates cost real money and took a developer to install correctly. That excuse is dead now. Most hosting providers include a free certificate automatically, and turning it on is usually a single click inside your hosting dashboard. Sometimes it’s already on without you doing anything at all.
If your site’s still running on plain HTTP today, there’s rarely a good reason left for it. The cost argument disappeared years ago.
What actually changes once it’s on
- The address bar shows a padlock instead of a warning.
- Data moving between your visitor’s browser and your server gets encrypted, so it can’t be intercepted in plain, readable form.
- Search engines stop treating your site as a lesser option compared to secured competitors.
- Forms on your site, including anything collecting names, emails, or payment details, stop looking like a liability the moment someone starts typing.
Why some sites “have SSL” and still show warnings
Every so often we get a call from an owner who insists they already have SSL set up, because someone flipped it on at some point, and they’re still getting the warning anyway. Almost every time, it’s what’s called mixed content: the certificate itself is active, but somewhere on the page an image, a stylesheet, or a script is still being pulled in over the old plain HTTP address instead of the secure one. Browsers see that leftover unsecured piece and flag the whole page anyway, padlock and all, sometimes with a smaller warning icon instead of the big red one.
This usually traces back to one thing: content, like a header image or an embedded video, that was uploaded to the site back when it was still running on HTTP, and nobody went back through and updated those old addresses after the switch. Most modern website platforms have a setting or a simple built-in tool that will find and update every one of these leftover links in one pass. If your host or web team says the site “has SSL” and you’re still seeing a warning, mixed content is almost always the reason, and it’s a five-minute cleanup once you know to look for it.
Where this actually costs you money
Think about the pages on your site doing the real work: a contact form, a quote request, a booking calendar. A local attorney’s site we looked at had exactly this setup, a clean-looking contact page with fields for name, phone, and a short description of the legal issue, sitting on a domain that had never had SSL turned on. Visitors landing there from a paid ad saw the warning, assumed the page wasn’t safe to type personal information into, and closed the tab before ever touching the form. The ad spend to get them there was already spent. The lead was gone before it ever had a chance to exist.
The same thing happens with a dentist’s booking widget, a contractor’s quote request, or a real estate agent’s lead capture form. Any page asking a stranger to type in their name, phone number, or details about their situation is exactly the kind of page where a missing padlock does the most damage, because it’s the moment a visitor is deciding whether to trust you with something personal.
Check your own site right now
Open a new tab, type in your own website address, and look at the bar next to it. Padlock, you’re fine. Warning label or a plain “i” icon with no padlock, you’ve got a five-minute fix waiting.
Check it on your phone too, not just your desktop browser. Most owners only ever look at their site from the same laptop they built it on, and mobile visitors are usually the bigger slice of traffic anyway. If the padlock’s missing there, it’s missing for everyone.
Most hosts have this under a section called SSL, security, or certificates in the dashboard. If you can’t find it after a few minutes of looking, that’s a two-minute phone call to your host, not a project. Ask them directly whether a free certificate is already available for your domain, most of the time the answer is yes and it just needs to be switched on.
Mistakes that undo the fix
- Turning it on but not forcing it. Some setups leave both the plain and secure versions of the site reachable at the same time. Visitors and search engines end up split between two versions of the same site instead of being funneled to the secure one automatically.
- Forgetting internal links. Old menus, buttons, and internal links sometimes still point to the old plain address out of habit, which can trigger the mixed content warning described above.
- Letting an older, manually purchased certificate expire. Unlike the free kind most hosts now renew automatically, an older certificate can quietly expire without warning, and the site drops right back to “Not Secure” until someone happens to catch it.
Once it’s set up correctly and forced across the whole site, none of this needs regular attention afterward. It’s one of those fixes you do right one time and then forget about, which is exactly why it’s worth doing correctly the first time instead of leaving it as an ongoing risk.
Where the real waste is
Here’s the part that bugs me. Businesses will spend real money driving traffic to a site through ads, then lose a chunk of those visitors right at the front door because of a fix that costs nothing and takes five minutes. That’s money doing push-ups, working hard and going nowhere.
I coach my kid’s Saturday soccer team, and I explain budgets to them in juice box math: if you spend your snack money getting to the field and then don’t show up to play, you wasted the trip. Ad spend that lands on a “Not Secure” warning is the same wasted trip, just with bigger numbers behind it.
This is part of what we check during a broader SEO review, along with the dozen other small technical things that quietly cost more traffic than they should.
The move: open your site right now, check the address bar, and if there’s no padlock, ask your host to turn on the free certificate today.
Want your site’s security actually checked? That’s part of our website care plans.
Frequently asked questions
Does SSL cost money to set up?
Not anymore for most sites. The majority of hosting providers include a free certificate, and turning it on is usually a single click in the hosting dashboard rather than a paid service.
Does SSL actually affect my Google ranking?
Yes. Google has confirmed HTTPS factors into how it evaluates sites, so running without it puts you at a disadvantage in search on top of scaring off visitors directly.
How do I know if my site already has SSL?
Look at your own website’s address bar. A padlock icon means you’re covered. A “Not Secure” warning or missing padlock means it still needs to be turned on.
