If your website address still starts with http rather than https, that is something worth fixing today rather than next month. An SSL certificate, and the HTTPS it enables, has shifted from a nice-to-have to a basic requirement for customer trust, search rankings and legal compliance in South Africa. The encouraging part is that you almost never need to pay for it, and switching it on is usually a quick, one-time job. Yet a surprising number of small business sites still run without it, quietly turning visitors away.
This guide explains what an SSL certificate actually is in plain language, why every South African website needs HTTPS, how to check whether yours is working correctly, and exactly how to get it sorted. By the end you will know whether your site is secure, and what to do if it is not.
📋 Key Takeaways
What is an SSL certificate?
An SSL certificate encrypts the connection between your website and the person visiting it, so that anything they enter, from a contact form to card details, cannot be read if it is intercepted in transit. When the certificate is active, browsers show a padlock in the address bar and your address changes from http to https, where the s stands for secure. It is the same technology that protects online banking, applied to your website.
Without a certificate, data travels in plain text, and modern browsers now actively warn visitors that your site is Not Secure. That warning appears before anyone has read a single word of your content, which is precisely the wrong first impression to make. For an unfamiliar visitor deciding whether to trust your business, a security warning is often enough to send them straight back to the search results.
Why your South African site needs HTTPS
There are four solid reasons to have HTTPS, and they reinforce one another. The first is trust: visitors recognise the padlock and are increasingly wary of the Not Secure label. The second is search visibility, because Google uses HTTPS as a ranking signal and consistently favours secure sites over insecure ones. Neither of these is something a small business can afford to give away to competitors.
The third reason is compliance: HTTPS is effectively a baseline expectation under POPIA, which requires you to take reasonable steps to secure personal information. The fourth is payments, since no reputable payment gateway will let you take card payments on an insecure page. Taken together, these four reasons move SSL firmly out of the optional column and into the essentials for any serious business website.
How to check if you already have it
Checking is simple. Visit your website and look at the address bar: a padlock icon and an address starting with https means SSL is active and working. A Not Secure label, or an address starting with http with no padlock, means the certificate is missing or misconfigured and needs attention. This takes only a few seconds to confirm.
It is also worth clicking through a few inner pages and, if you have one, your checkout, because it is entirely possible for the home page to be secure while an older page or an embedded form still loads insecurely. A site that is only partly secure can still trigger warnings, so check the pages where customers enter information most carefully.
Do you have to pay for SSL?
No, and this surprises many business owners. Free, automatically renewing certificates from Let’s Encrypt are trusted by every major browser and are included with any quality hosting plan. For a standard business website, a free certificate provides exactly the same encryption strength as an expensive paid one, so paying extra rarely makes sense.
Our web hosting plans include free SSL as standard, and even the free hosting plan comes with it switched on. Be cautious of any host that charges a hefty annual fee for a basic certificate, because it is often a sign of dated infrastructure or padded pricing. The encryption you get for free is the same encryption you would otherwise pay for.
💡 Pro Tip: Before paying for any SSL certificate, check whether your host already offers free Let’s Encrypt SSL. For the vast majority of business sites, the free certificate is all you will ever need.
Types of SSL certificate
For the overwhelming majority of South African small businesses, a free Domain Validated certificate is exactly right. Organisation and Extended Validation certificates add layers of identity verification that only larger, regulated or finance-related organisations typically need, and they come at a real cost, so there is no reason to over-buy.
How to get SSL on your site
For most owners this is a quick, one-time task, and on good hosting it is often switched on for you automatically. If you need to do it yourself, the steps are straightforward:
Fixing the Not Secure warning
If you already have a certificate but still see Not Secure, the usual culprit is mixed content, meaning some images, scripts or links on the page are still loading over http even though the page itself is on https. The browser flags the whole page as insecure until every element loads securely. On WordPress, a simple plugin can often find and fix these references automatically, saving you from editing pages by hand.
⚠️ Watch Out: After moving to HTTPS, set up a permanent redirect from http to https. Without it, both versions of your site can exist at once, which confuses visitors and search engines and can split your SEO value across two addresses.
SSL and your SEO
Beyond being a direct ranking signal, HTTPS supports your SEO indirectly through the trust it builds and the lower bounce rates that come from visitors feeling safe on your site. People stay longer and engage more when there is no security warning between them and your content. It is a foundational piece that works hand in hand with the tactics in our guide on improving your SEO in South Africa.
Put simply, SSL on its own will not rocket you up the rankings, but lacking it actively holds you back and undermines everything else you do. That is why it belongs firmly in the must-have column rather than the someday list.
Frequently asked questions
Is free SSL as good as paid SSL?
For encryption, yes. A free Let’s Encrypt certificate secures your site exactly as well as a paid Domain Validated certificate. Paid certificates mainly add identity verification, which only larger organisations usually need.
Will adding SSL slow down my website?
No. Modern HTTPS has a negligible performance cost and can even enable faster connection protocols. Any tiny overhead is far outweighed by the trust and SEO benefits of being secure.
What happens if my SSL certificate expires?
Visitors see a prominent security warning and many will leave immediately. Free certificates from good hosts renew automatically, so expiry is rarely a problem when your hosting is set up correctly.
Do I need SSL if my site has no online payments?
Yes. Even a simple brochure site with a contact form collects personal information and benefits from the trust, SEO and compliance that HTTPS provides. It is now the baseline for every website.
SSL and taking online payments
If you sell anything online, SSL stops being optional and becomes a hard requirement. No reputable South African payment gateway, including the popular local options, will allow you to process card payments on a page that is not secured with HTTPS. The encryption protects your customers’ payment details as they travel from their browser to the gateway, and it is a baseline condition of the card industry’s security standards. Without it, you simply cannot take payments safely or legally.
Just as importantly, customers have learned to look for the padlock before entering card details. A checkout page flagged as Not Secure will send even keen buyers running, undoing all the work that got them to the point of purchase. For any store, securing the entire site, not just the checkout, is the only sensible approach, because a warning on any page erodes the trust you need at the moment of sale.
Quick recap
Still seeing Not Secure? Email us at [email protected] and we will sort your certificate out, or move you to hosting that includes free SSL.
