SSL certificate: why the browser lock is essential

What is an SSL certificate in simple terms?

An SSL certificate enables your website to load via HTTPS. Strictly speaking, modern websites use TLS, but SSL is still the common everyday term. Visitors see a lock or security symbol and the address starts with https://.

The certificate helps confirm that the browser is talking to the correct server and encrypts the connection between visitor and website. This prevents data from being read or changed in transit, especially on public Wi-Fi, forms, accounts and payment flows.

Is SSL required for websites in Germany?

There is no single sentence in German law saying every website must have SSL. In practice, HTTPS is hard to avoid. Article 32 GDPR requires appropriate technical and organisational measures to protect personal data. If a form, booking tool, newsletter signup or customer login is used, unencrypted transfer is difficult to justify.

Even without a form, HTTPS is now standard. Browsers check connection security and warn users on unsafe pages. For a business, a non-HTTPS website is a poor signal before the visitor has even read your offer.

Why does the browser show “Not secure”?

The warning usually appears when the page loads only via HTTP, the certificate has expired, the certificate does not match the domain or the page loads mixed content. Mixed content means the page itself is HTTPS but images, scripts or styles still load via HTTP.

Visitors do not see the technical detail. They see a warning. That is why SSL should be tested after setup: home page, subpages, forms, booking pages, embeds and redirects.

• certificate missing or expired
• certificate issued for the wrong domain
• www and non-www versions not covered correctly
• assets still loading via http://
• HTTP to HTTPS redirects missing or wrong

How does HTTPS affect trust, SEO and conversions?

The browser lock does not sell by itself, but the absence of it can cost enquiries. A warning beside the address bar creates doubt, especially for local services, practices, trades and consultants that rely on first contacts through the website.

Google has treated HTTPS as a quality signal for years. It does not replace useful content or local SEO, but a modern website without HTTPS looks outdated. For small businesses, SSL belongs in the same foundation as the Impressum, privacy policy, mobile design and performance.

Which SSL certificate type is enough?

For most small businesses, a domain validation certificate is sufficient. It checks control over the domain and can often be issued automatically at no licence cost. Organisation validation or extended validation may matter for larger or special cases, but they are rarely required for a normal SME website.

A clean setup matters more than an expensive certificate: main domain, www version, redirects, subdomains and automatic renewal. Public TLS certificates do not last forever; they must be renewed regularly, so automation prevents sudden browser warnings.

What does SSL cost for small businesses?

The certificate itself is often free today. Many hosting providers include Let’s Encrypt or similar solutions. Costs usually come from setup and maintenance: DNS checks, activation, redirects, mixed-content fixes, form tests and renewal monitoring.

On a simple site this is manageable. Older WordPress systems, several domains, external scripts or shop systems can make it harder. In our website subscriptions, SSL is part of the technical foundation from Starter at 79 euros per month; Business is 149 euros and Premium 299 euros per month.

How do you check whether SSL is configured correctly?

Open your website with https:// and click the symbol next to the address. Check which domain the certificate covers. Also test http://, www and non-www; all variants should redirect to the correct HTTPS version.

Then test key pages: contact, enquiry, booking, login, Impressum and privacy policy. If the lock disappears, mixed content or an incorrect integration is often the reason. Include SSL checks after relaunches, plugin updates, domain moves and server changes.