Do you need an SSL certificate, and what should it cost? (Usually nothing)
Yes, you need one — in 2026 browsers mark sites without HTTPS as “Not Secure”, Google ranks them lower, and the fast HTTP/2 and HTTP/3 protocols require it — but the honest answer to what it should cost is, for most sites, nothing. A free Domain Validation certificate from Let’s Encrypt gives you the exact same encryption as a $500 certificate, and Google gives no ranking advantage to paid certificates, so a host that charges for basic SSL as a paid add-on is overcharging for something that should be included and automatic. The three tiers — DV (free), OV ($20–250/year) and EV ($100–400/year) — differ only in what the Certificate Authority verifies about you, not in the strength of the encryption, and since browsers removed the EV “green bar” in 2019, even an expensive EV certificate now looks identical to a free one to your visitors: the same padlock, no visible difference. So the historical reason to pay is largely gone. What actually matters isn’t which certificate you buy but that it auto-renews reliably and is monitored, because the real failure mode is silent expiry — and with certificate lifespans shrinking toward 47 days by 2029, manual renewal is becoming untenable and automation is mandatory. Two myths are worth killing on the way: HTTPS makes your site faster, not slower, because it unlocks modern protocols; and the padlock proves your connection is private, not that the site is safe, since phishing sites use HTTPS too. On the static sites we build, HTTPS is free, auto-renewing and included — you’d only pay for OV or EV if a genuine compliance or procurement rule called for it, and we’ll tell you when it doesn’t.
What HTTPS actually does, and why it’s non-negotiable
An SSL certificate is what turns http:// into https:// and encrypts the connection between a visitor’s browser and your server, so that anyone intercepting the traffic sees scrambled gibberish instead of passwords, card numbers or personal details (My-SSL, 2026). The certificate also lets the browser confirm that the holder controls the domain — the baseline of trust that HTTPS provides. (“SSL” is really a habit; the actual protocol has been TLS for years.)
It stopped being optional some time ago. Without a valid certificate, Chrome shows a “Not Secure” warning that actively discourages visitors from proceeding, Google uses HTTPS as a ranking factor, and the fastest web protocols — HTTP/2 and HTTP/3 — simply require it (FreeGetStats, 2026). There’s a legal dimension too: regulations like GDPR, PCI DSS and HIPAA require encrypted transmission, so if your site collects any personal data at all — even an email address in a contact form — SSL isn’t merely recommended, it’s often required (FreeGetStats, 2026). This is the security-and-trust piece of the total picture our pillar on what a website really costs lays out.
Free versus paid: the encryption is identical
Here’s the fact the sales pages work hard to obscure. A free Domain Validation certificate from Let’s Encrypt uses the same cryptographic strength as a paid certificate costing hundreds of dollars — the encryption is identical, and browsers and search engines treat all trusted certificates equally (Evolve, 2026). Let’s Encrypt, run by the nonprofit Internet Security Research Group, already secures over 300 million sites, and Google has repeatedly confirmed that HTTPS is a ranking signal regardless of which Certificate Authority you pay (BeoHosting, 2026).
So what does the money buy? Not security. Paid certificates charge for a higher validation tier, a financial warranty in case of breach, vendor support, longer issuance periods and brand — you’re paying for what the CA verifies about you and for support, not for stronger encryption (Certimon, 2026). The practical consequence is direct: for a blog, portfolio, informational site or small business that doesn’t process payments, free DV does everything you need, and a host that bills basic SSL as a paid add-on is unbundling an essential the same way it unbundles backups and DDoS protection.
DV, OV, EV — and the green bar that’s gone
When a paid certificate genuinely makes sense, it’s about validation, not encryption. The three levels differ only in what the Certificate Authority checks before issuing.
| Level | What the CA verifies | Time | Cost/year |
|---|---|---|---|
| DV (Domain) | You control the domain | Minutes | Free (Let’s Encrypt) |
| OV (Organization) | Your organization legally exists | 1–3 days | ~$20–250 |
| EV (Extended) | Full legal and operational vetting | 1–5 days | ~$100–400 |
Most sites do fine with DV, because the encryption is the same across all three and the difference is only in identity verification (My-SSL, 2026). The pivotal 2026 caveat is what happened to the visible payoff: browsers removed the EV “green bar” that once displayed a verified company name in the address bar — Chrome in September 2019, Firefox soon after — so today DV, OV and EV all look identical to visitors, the same padlock with no green and no organization name on show (thatmy, 2026). The famous reason banks paid for EV is simply no longer visible to the people it was meant to reassure. OV and EV still have narrow uses — where the certificate’s verified metadata carries compliance or procurement significance — but as a trust signal to general visitors, paying for them buys a padlock that looks exactly like the free one.
The thing that actually matters: renewal, not the certificate
If there’s one place to spend your attention, it’s not the purchase — it’s expiry. Free or paid, every certificate expires, and a lapsed certificate causes the same damage regardless of what you paid: browser warnings, broken integrations and lost revenue (Certimon, 2026). Worse, the failure is silent. Auto-renewal handles most cases, but it can quietly break when DNS changes, ports get blocked, a config drifts, or a renewal job stops running after a server migration — and nobody notices until the site throws a security warning (thatmy, 2026).
This is becoming more pressing, not less. The CA/Browser Forum has approved shorter certificate lifetimes — a 200-day maximum from March 2026, dropping toward a 47-day maximum by 2029 — which makes renewing by hand genuinely untenable and puts automation from optional to mandatory (My-SSL, 2026). Let’s Encrypt’s 90-day auto-renewing model is already built for this world, which is part of why it’s the sensible default. The practical takeaways are to automate renewal, enable HSTS so browsers always use HTTPS, and monitor expiry independently — especially since Let’s Encrypt stopped sending expiration reminder emails in mid-2025, removing a safety net many teams relied on (Certimon, 2026).
Two myths worth killing
Two beliefs about HTTPS persist long past their expiry date. The first is that SSL slows your site down. It’s the opposite: modern TLS 1.3 adds a negligible single round trip, and having HTTPS unlocks HTTP/2 and HTTP/3, which are markedly faster than the HTTP/1.1 that non-secure sites are stuck on — so a properly configured HTTPS site is faster than the same site in plain HTTP, a point that connects directly to the performance work everything here is built around (FreeGetStats, 2026).
The second, more dangerous myth is that a padlock means a site is safe. HTTPS proves the connection is private, not that the site is trustworthy — DV certificates are free for any domain, so phishing and malware sites use HTTPS routinely, and the FBI has warned about exactly this since 2018 (thatmy, 2026). HTTPS encrypts the traffic to and from your server; it says nothing about what runs on the server, so a site with a perfect certificate and an unpatched plugin is still a compromised site. Encryption and security are separate concerns, and you need both.
Why we include it — and when to pay for more
Stated plainly: on the static sites we build, HTTPS is free, auto-renewing and included, not a line item. Because a free Let’s Encrypt certificate provides identical encryption and no SEO disadvantage, and because our sites are served through infrastructure where issuance and 90-day renewal are automated, the padlock is simply part of a properly hosted site — the same way reliable hosting, backups and DDoS protection come with the foundation rather than sold back as extras. Charging a small business for basic SSL is, in our view, charging for something that should never have been optional.
The honest gate is about when to pay for more, and the answer is narrow. You’d step up to an OV or EV certificate only when a genuine requirement calls for it — a procurement process that demands verified organization identity in the certificate, a compliance policy, or a B2B contract — not for a trust signal to general visitors, which the dead green bar no longer provides. If you run large-scale payments or a regulated financial service, that conversation is worth having; short of that, we’ll tell you a free DV certificate is exactly right, because it is.
The padlock should be free, automatic, and included
SSL is the clearest small example of the theme running through this whole library: an essential that the market has learned to unbundle and upsell, when doing it properly means including it and automating it once. The encryption is free, the renewal should be automatic, and the only real risk — silent expiry — is a monitoring problem, not a purchasing one. Pay for validation only where a specific rule requires it, and treat any “SSL add-on” charge as a flag about how the rest of your hosting is priced.
Get that right and HTTPS stops being a recurring worry or a surprise fee and becomes what it should be: an invisible, automatic property of a well-built, well-hosted site. It’s the same “do it right once” logic behind our guides on hosting cost and DDoS protection, and behind the whole approach our pillar on what a website costs sets out — where the cheapest version of an essential is the one that’s built in, not billed monthly.
Frequently asked
- Do I need an SSL certificate?
- Yes — in 2026 it's effectively mandatory for any serious website. Without one, browsers display a 'Not Secure' warning next to your address, Google ranks HTTP sites lower because HTTPS is a ranking signal, and visitors distrust the site. On top of that, the fastest web protocols (HTTP/2 and HTTP/3) require HTTPS, and privacy regulations like GDPR, PCI DSS and HIPAA require encrypted transmission if your site collects any personal data — even just an email address through a contact form. The question isn't whether you need SSL; it's which kind, and the answer for most sites is the free one.
- How much should an SSL certificate cost?
- For most websites, nothing. A free Domain Validation certificate from Let's Encrypt provides the exact same encryption as a certificate costing hundreds of dollars, and Google gives no ranking advantage to paid certificates over free ones. You only pay when you specifically need higher validation (OV certificates run roughly $20–250 a year, EV $100–400), a warranty, vendor support, or wildcard coverage. If a host charges you for a basic SSL certificate as a paid add-on, that's a sign it's unbundling something that should be included and automatic — the same pattern that turns backups and DDoS protection into surprise line items.
- What's the difference between free and paid SSL certificates?
- Not the encryption — that's identical. A free Let's Encrypt DV certificate uses the same cryptographic strength as a $500 EV certificate, and browsers and search engines treat all trusted certificates equally. What you pay for with a paid certificate is a higher validation tier (the CA verifying your organization exists, not merely that you control the domain), a financial warranty, vendor support, longer issuance periods, and brand. For a personal site, blog, portfolio or small business that doesn't process payments, a free DV certificate does everything you need.
- What are DV, OV and EV certificates?
- They're three levels of validation that differ only in what the Certificate Authority verifies about you. DV (Domain Validation) confirms you control the domain — automated, issued in minutes, free via Let's Encrypt. OV (Organization Validation) also verifies your organization legally exists, takes one to three days, and costs around $20–250 a year. EV (Extended Validation) involves full legal and operational vetting for $100–400 a year. Crucially, browsers removed the EV 'green bar' with the organization name back in 2019, so in 2026 DV, OV and EV all look identical to your visitors — the same padlock, no visible difference.
- Does an SSL certificate slow down my website?
- No — it speeds it up. This is a common misconception left over from the early days of HTTPS. Modern TLS 1.3 adds negligible latency (a single extra round trip in the handshake), and having HTTPS unlocks the HTTP/2 and HTTP/3 protocols, which are significantly faster than the old HTTP/1.1 that non-secure sites are stuck on. The performance gain from those modern protocols far outweighs the tiny encryption overhead, so a properly configured HTTPS site is faster than the same site over plain HTTP, not slower.