Look at the address bar of any bank, bKash or Daraz website and you will see https:// and a small padlock or settings icon. That padlock means the website uses an SSL certificate. If your own business website still shows "Not secure" in Chrome, visitors notice, and some leave before your page even loads. So what is an SSL certificate? This guide explains how it works, how HTTPS protects your visitors, why it matters for Google and online payments, and how to make sure your website uses it correctly.
What is an SSL certificate?
An SSL certificate is a small digital file installed on your web server that does two jobs:
- Encryption: it scrambles the information travelling between a visitor's browser and your website, so nobody in between can read or change it.
- Identity: it proves that the website really belongs to the domain shown in the address bar, because a trusted certificate authority has verified control of that domain.
Technically, the modern protocol is called TLS (Transport Layer Security), and SSL is its older predecessor. Everyone still says "SSL certificate", so we will too. When a website has a valid certificate, its address starts with https:// instead of http://. The "S" stands for secure.
How HTTPS works, in plain language
Imagine sending a letter from Maijdee to Dhaka. With plain HTTP, the letter travels as an open postcard: anyone who handles it along the way can read it. With HTTPS, the letter is locked in a box, and only the receiver has the key.
When someone opens your website:
- The browser asks your server for its certificate.
- It checks that the certificate is valid, not expired, and issued for your exact domain.
- The browser and server agree on a secret key that only they know.
- Everything after that, including form entries, passwords, and payment details, is encrypted with that key.
All of this happens in a fraction of a second, and modern servers handle it with almost no impact on speed.
Why every website needs SSL, even a small one
1. Browsers warn visitors about non-HTTPS sites
Chrome, Firefox and Safari mark HTTP pages as "Not secure", especially pages with forms. A customer who sees that warning on your contact form may decide not to send their phone number.
2. Google prefers secure websites
Google has confirmed that HTTPS is a ranking signal. It will not push a weak page to the top on its own, but between two similar pages, the secure one has an advantage. It also protects the referral data you see in analytics.
3. Online payments require it
If you accept payments through bKash, Nagad, SSLCommerz or any card gateway, HTTPS is required. Payment providers will not connect to a website that sends customer data over plain HTTP. A payment gateway also needs a working checkout and a clear refund policy, so plan these together.
4. Protects logins and admin panels
Every time you log in to WordPress or your website's admin panel over HTTP, your password travels unencrypted. On public Wi-Fi at a café or office, that is a real risk.
5. Builds trust
The padlock is a small but familiar sign of a professional, maintained website. For shops, clinics and schools that collect personal information, it is expected.
Types of SSL certificates
| Type | What is verified | Good for |
|---|---|---|
| Domain Validated (DV) | That you control the domain | Business websites, blogs, shops, schools, news portals |
| Organisation Validated (OV) | Domain plus the organisation's legal existence | Larger companies and institutions |
| Extended Validation (EV) | Detailed checks of the organisation | Banks and financial services with specific requirements |
| Wildcard | Covers all subdomains, such as *.yourdomain.com | Sites with many subdomains |
For most small and medium businesses in Bangladesh, a free DV certificate gives exactly the same encryption strength as a paid one. Browsers show the same padlock. Paid OV and EV certificates add verified company information to the certificate, which some corporations and tenders require.
Free SSL: is it really safe?
Yes. Free certificates from AutoSSL in cPanel and from Let's Encrypt use the same modern encryption as paid DV certificates and are trusted by every major browser. The main difference is that free certificates are valid for a shorter period and are renewed automatically. On good hosting, you never have to think about it. All of our web hosting plans include free SSL that is installed and renewed automatically.
How to check whether your website has SSL
- Open your website and look at the address bar. It should start with https:// and show the padlock or settings icon.
- Type your address with http:// in front. A correctly set-up site redirects to https:// automatically.
- Click the padlock to see who issued the certificate and when it expires.
- Check both versions of your domain: with and without www.
How to enable SSL on a cPanel website
- Make sure your domain points to your hosting (correct nameservers or A record).
- In cPanel, open SSL/TLS Status and click Run AutoSSL if your domains are not yet covered.
- Force HTTPS: in cPanel open Domains and turn on Force HTTPS Redirect for your domain.
- In WordPress, go to Settings → General and change both URLs to start with https://.
- Check pages for "mixed content" (see below).
If your domain is new, wait until it has fully pointed to your hosting. AutoSSL can only issue a certificate once the domain resolves to your server. Our article on DNS and nameservers explains how long that can take.
Fixing "mixed content" warnings
Sometimes a page loads over HTTPS but still shows a warning instead of a clean padlock. This usually means some images, scripts or fonts are still loaded with http:// addresses. The browser calls this mixed content. To fix it:
- Update old image links in posts and pages to https://.
- Use a search-and-replace tool or plugin to change http://yourdomain.com to https://yourdomain.com across the database.
- Check your theme settings, logo and favicon URLs.
- Remove or update embedded content from old websites that do not support HTTPS.
The browser's developer console (press F12) lists each insecure item, which makes them easy to find.
Common SSL errors and what they mean
| Error | Meaning | Fix |
|---|---|---|
| Your connection is not private | Certificate is missing, expired or for a different domain | Run AutoSSL or reissue the certificate |
| NET::ERR_CERT_DATE_INVALID | Certificate expired, or the visitor's device clock is wrong | Renew the certificate; ask the visitor to check their date and time |
| Not secure on some pages | Mixed content | Replace http:// links with https:// |
| Works without www but not with www | Certificate does not cover both names | Include both in AutoSSL |
Does SSL slow down a website?
Not in any way your visitors will notice. Modern TLS is very efficient, and HTTPS also enables HTTP/2 and HTTP/3, which are usually faster than old HTTP. A secure site on a LiteSpeed server, like our WordPress hosting, often loads faster than the same site over plain HTTP.
Frequently asked questions
Do I need SSL if my website does not sell anything?
Yes. Browsers still mark HTTP pages as not secure, contact forms collect personal information, and Google favours HTTPS for all websites.
How much does an SSL certificate cost?
A standard certificate is free with our hosting. Paid OV, EV or wildcard certificates are only needed for special requirements.
Will switching to HTTPS hurt my Google ranking?
No, as long as every HTTP page redirects permanently (301) to its HTTPS version. Google treats it as the same page.
How often does the certificate need to be renewed?
Free certificates renew automatically every few months. You only need to make sure your domain stays pointed at your hosting.
Does SSL protect my website from hacking?
No. SSL protects data in transit. You still need updates, strong passwords, backups and security plugins to protect the website itself.
Want your website secured with HTTPS today? Order hosting with free SSL or contact us and we will help move your existing website to HTTPS.