An SSL certificate secures an encrypted connection between the visitor's browser and the server, thereby protecting the data being transmitted. Without it, browsers mark the site as not secure, which puts visitors off, especially on forms and payments. For ordinary websites, a basic domain-validated certificate is sufficient, which is usually free and renews automatically; organisation-validated certificates matter for financial and sensitive services. The most common problem is not the type of certificate but its expiry – visitors are shown a prominent security warning and the website becomes practically unusable. It therefore pays to have automatic renewal and a notification of approaching expiry. The certificate also needs to cover every subdomain in use. After deployment, it is worth checking that all addresses actually load over a secure connection.
See also: HTTPS and mixed content, Website maintenance and updates, Uptime monitoring.
