A customer opened her favorite online store to order a birthday cake. Before entering her payment details, she noticed something in the browser's address bar: the words "Not Secure" next to the URL. She hesitated for a moment, then closed the tab and ordered from another store that felt "safer." The cake shop lost the order—not because the cakes weren't good, not because the prices were high, but because it hadn't installed SSL.
The reality is even harsher: in many cases, modern browsers display a full warning screen before visitors can enter a site without SSL at all. Visitors who see that warning almost certainly leave and never return. A website without SSL isn't just losing trust—it's actively driving customers away.
SSL and HTTPS are often dismissed as confusing technical matters. But the core idea is simple: SSL is the technology that encrypts data between visitors and your website, and HTTPS is the secure version of the standard web protocol. This article explains how it works, the types of SSL certificates, realistic costs, how to install it, and its impact on customer trust and Google rankings.
What SSL and HTTPS Actually Are
SSL (Secure Sockets Layer) is a security technology that creates an encrypted connection between a visitor's browser and your website's server. Its modern version is called TLS (Transport Layer Security), but people still call it SSL. An SSL certificate is a digital file that proves your website's identity and enables that encryption.
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP—the protocol browsers use to load websites. The difference: HTTPS connections are encrypted with SSL/TLS, while HTTP connections are not.
To understand why this matters, imagine sending a letter. HTTP is like a postcard: anyone who handles it along the way can read its contents. HTTPS is like a sealed envelope: only the sender and receiver can open it. Between a visitor and your website, many "hands" can touch the data: public Wi-Fi networks, internet service providers (ISPs), routers, and data center equipment. Without encryption, all of them can read passing data—including passwords, addresses, and card numbers.
How SSL Works in Practice
The process runs automatically in milliseconds, unnoticed by users:
- The visitor's browser requests a secure connection to your server.
- The server sends its SSL certificate, containing the website's identity and a public key.
- The browser checks whether the certificate is valid—issued by a trusted authority, still in date, and matching the domain being visited.
- If valid, the browser and server create a "session key" known only to the two of them.
- All data sent during that session is encrypted with that key.
If any step fails—an expired certificate, a domain mismatch, or an unknown authority—the browser shows a warning. That's what happens when visitors see "Your connection is not secure" or "Invalid certificate."
Why Your Business Needs SSL
Protecting Customer Data
The most fundamental reason: if your website asks visitors for any data at all—names, emails, phone numbers, addresses, let alone payment details—that data must be encrypted. Without SSL, it travels in plain text and can be intercepted. For online stores, this isn't just a technical risk but a legal one: Indonesia's Personal Data Protection Law requires data controllers to maintain the confidentiality of the personal data they collect.
Building Trust
Modern browsers display security indicators that visitors see instantly: a padlock in the address bar for HTTPS sites, or a "Not Secure" label for those without it. For security-aware visitors—and their numbers are growing in Indonesia—the "Not Secure" label is a signal to leave. Global surveys consistently show that the majority of internet users will abandon a transaction if the site lacks security indicators.
Required by Payment Gateways
If you accept online payments, SSL is no longer optional. Payment services and card networks require HTTPS for processing transactions. Without SSL, you can't accept card payments or use most payment gateways—and even customers paying via manual bank transfer will still see the "Not Secure" label that destroys trust.
SEO and Google Rankings
Since 2014, Google has used HTTPS as a ranking signal. It's not the biggest factor, but it's real: between two sites of similar content quality, the HTTPS one tends to rank better. More importantly, Chrome shows full warnings for sites without HTTPS, and those warnings drive people away instantly—lost traffic doesn't care how good your content is.
Protection Against Attacks
HTTPS also protects your website from specific attack types: session hijacking, where attackers steal a visitor's login session to impersonate them, and content injection, where an ISP or attacker inserts ads or malicious scripts into the pages you send. Encryption makes such manipulation far more difficult.
Types of SSL Certificates
Not all SSL certificates are the same. They differ in validation level—how deeply the issuer verifies your identity—and in the scope of domains they cover.
Domain Validation (DV)
DV certificates only verify that you control the domain, usually by sending an email to a specific address or placing a special file on the server. The process is automated and can complete within minutes.
Pros: cheap (often free), fast, sufficient for most websites. Cons: only proves domain ownership, not business identity. To visitors, the padlock looks identical to more expensive certificates.
Best for: business websites, blogs, small online stores, landing pages.
Organization Validation (OV)
OV certificates verify domain ownership plus the identity of the owning organization—company name, address, and legal status. The process involves document checks and can take several days.
Pros: higher trust, shows the organization name in certificate details. Cons: more expensive and slower.
Best for: companies wanting to display official identity, B2B, institutions.
Extended Validation (EV)
EV is the highest validation level. The issuer performs thorough checks on your organization's legal existence and operations. In the past, browsers displayed the company name in the address bar for EV certificates, though modern browsers have changed this practice.
Pros: the highest trust level. Cons: the most expensive and complex; most browsers no longer visually distinguish EV from DV/OV.
Best for: financial institutions, large companies requiring maximum compliance and trust.
By Scope
- Single domain — protects one domain (e.g., namabisnis.com).
- Wildcard — protects the main domain and all its subdomains (*.namabisnis.com). Suitable if you have many subdomains like blog.namabisnis.com, toko.namabisnis.com.
- Multi-domain (SAN) — protects several different domains in one certificate (e.g., namabisnis.com, namabisnis.co.id, and namabisnis.net).
How Much Does SSL Cost
The most common question: how much does SSL cost? The answer ranges from free to tens of millions of rupiah per year.
Free SSL (Let's Encrypt)
Let's Encrypt is a nonprofit certificate authority providing free DV certificates. Most modern hosting and cloud services activate it automatically with scheduled renewal. For the majority of businesses, free SSL is entirely sufficient.
One thing to note: Let's Encrypt certificates are valid for 90 days and must be renewed automatically. Good hosting handles this without you noticing. If your website lacks automatic renewal, you'll need to renew manually every three months—or risk your site "suddenly becoming insecure" when the certificate expires.
Paid SSL
Paid certificates offer higher validation levels (OV/EV), warranties, and support. Price ranges in Indonesia:
| Type | Cost per year (estimate) |
|---|---|
| DV (Let's Encrypt) | Free |
| Paid DV | Rp300K–1.5M |
| OV | Rp1.5–5M |
| EV | Rp5–20M |
| Wildcard | Rp2–10M |
An honest question needs asking: does your business need a paid certificate? For most businesses, the answer is no. Free DV certificates provide encryption just as strong as expensive ones—the difference is only in identity validation level. The AES-256 encryption behind Let's Encrypt is the same as behind the most expensive EV certificate. If you need organizational validation for B2B or compliance purposes, then OV/EV makes sense.
How to Install SSL and Enable HTTPS
Installing SSL sounds technical, but for most scenarios the process is simple:
If Your Website Is on Modern Hosting
Open your hosting panel and look for the SSL or "Let's Encrypt" menu. Click activate for your domain, wait a few minutes, and you're done—certificate installed, HTTPS active. Most modern hosting (especially managed cloud and VPS) even activates it automatically when you add a domain.
If Your Website Is on a Website Builder Platform
Platforms like WordPress with managed hosting, Wix, or Squarespace usually handle SSL fully automatically. You don't need to do anything except make sure the feature is enabled in settings.
If You Use a CDN
CDN services like Cloudflare provide free SSL at the CDN level—even for websites whose origin server doesn't have SSL yet. This is a popular solution: Cloudflare handles encryption between visitors and the CDN, while you set up encryption between the CDN and your origin server.
After the Certificate Is Installed: The Often-Forgotten Steps
Installing the certificate is only the first step. Many websites have SSL but still have problems because of these issues:
- Redirect HTTP to HTTPS. Make sure all visitors opening the http:// version are automatically redirected to https://. Without this, some visitors still land on the insecure version.
- Mixed content. If an HTTPS page loads images, scripts, or styles from http:// URLs, browsers show warnings and block some content. Check your pages with a "Mixed Content Checker" and fix all leftover URLs.
- Update internal links. All links within your website, on social media, and in marketing materials should point to the HTTPS version.
- Update the sitemap in Google Search Console. After migrating to HTTPS, resubmit your sitemap and watch for any temporary ranking dips.
How to Check Whether Your Website Is Secure
You can check your website's SSL status yourself:
- Look at the address bar. If there's a padlock, the site uses valid HTTPS. If it says "Not Secure," it doesn't.
- Click the padlock. The browser shows certificate details: issuer, validity period, and covered domains.
- Use online tools. Sites like SSL Labs (SSL Server Test) provide complete reports: whether the certificate is valid, encryption configuration, and issues to fix.
- Test in different browsers. Chrome, Safari, and Firefox sometimes show different warnings for the same issue.
Common SSL Mistakes
Buying Paid SSL When You Don't Need It
Many vendors still sell paid SSL as "mandatory" when free certificates are sufficient. Before paying, ask: is my need only encryption (the answer is almost always yes)? If so, free SSL is adequate.
Forgetting to Renew
Expired certificates are the most common cause of websites "suddenly becoming insecure." Automated calendars and auto-renewal are the solution. Good hosting manages this without you noticing.
Only Securing the Checkout Page
Some websites in the past only installed SSL on the payment page. This is wrong: the entire website should be HTTPS. Visitors filling contact forms, logging in, or just browsing also send data that needs protection. Besides, the "Not Secure" label on other pages still destroys trust.
Not Setting Up Redirects
Having the certificate installed while visitors can still open the HTTP version is only half the work. Make sure a 301 redirect from HTTP to HTTPS is in place at the server level, so visitors and search engines are always directed to the secure version.
Ignoring Expired Certificates Internally
Internal or staging websites using expired certificates can train teams to "ignore warnings"—a dangerous habit when they face real ones. Always keep certificates valid in all environments, including staging.
SSL Myths Worth Clearing Up
"SSL Makes Websites Slow"
This myth dates back to the early days of encryption, when the SSL handshake added a significant load to servers. In practice today, modern encryption runs very fast, and its impact on page speed is barely noticeable. In fact, the opposite is true: the faster HTTP/2 protocol only works over HTTPS. HTTPS websites are often actually faster than their HTTP versions because they can use HTTP/2 and other modern performance features.
"SSL Is Only for Online Stores"
This assumption is wrong. Every website that collects any data—contact forms, newsletter signups, user logins—sends data worth protecting. Besides, the "Not Secure" label in browsers doesn't distinguish online stores from company profile sites. Visitors see it on all types of websites, and the perception it creates is equally damaging.
"Free SSL Isn't as Secure as Paid SSL"
The encryption provided by free Let's Encrypt certificates is exactly as strong as that of the most expensive paid certificates. Both use the same encryption standards. The difference is only in identity validation level, not encryption strength. What actually distinguishes security is how you manage your server and its updates, not the certificate's price.
"Once SSL Is Installed, the Job Is Done"
Installing a certificate is the beginning, not the end. Certificates must be renewed before expiry, redirects must be maintained, mixed content must be prevented, and additional certificates may be needed when you add new subdomains or domains. A healthy website requires regular care—and that applies to SSL too.
SSL for Email and Subdomains
SSL doesn't stop at your main website. Two areas are often overlooked:
- Email. If you use email with your own domain (like [email protected]), your mail server also uses certificates to encrypt connections. An expired certificate on a mail server can make email clients show security warnings on messages you send and receive.
- Subdomains. Many businesses run services on subdomains: blog.namabisnis.com, toko.namabisnis.com, or panel.namabisnis.com. Every subdomain serving visitors needs protection. A wildcard certificate covers all subdomains at once—a practical choice if you have many.
Also check the third-party services you use: do the applications you access through a browser use HTTPS? The habit of checking the padlock in the address bar—on all services, not just your own website—is a security habit worth spreading across your entire team.
SSL in the Broader Security Context
SSL is one foundation of website security, but not the only one. An HTTPS website can still be hacked if its CMS isn't updated, its passwords are weak, or its server isn't maintained. SSL protects data in transit; it doesn't protect data at rest.
Good security is layered: SSL for encryption, regular updates to close holes, backups for recovery, and monitoring for early detection. We cover all these layers in depth in our website security guide. SSL is the first and cheapest layer—there's no excuse for skipping it.
Hosting choices also affect SSL ease: modern hosting manages certificates, renewals, and redirects automatically, while older hosting often leaves everything to you. If your website is still on hosting without automatic SSL, consider migrating to better hosting.
Conclusion
Back to the cake shop. The problem wasn't the cakes' taste or the prices—it was one simple thing that could be fixed in minutes: SSL. After installing a free certificate from Let's Encrypt and enabling HTTPS, the "Not Secure" label disappeared, replaced by a reassuring padlock. The orders that had been lost to customer hesitation started coming back.
SSL is one of the best effort-to-result security investments that exists: free or cheap, installable in minutes, and it immediately changes how visitors perceive your website. It protects customer data, meets legal obligations, supports SEO, and most importantly, builds trust—the asset hardest to earn and easiest to lose in the digital world.
If your website still shows "Not Secure" in browsers, don't delay. Check your hosting panel, activate SSL, make sure the HTTP-to-HTTPS redirect works, and check for mixed content. If you're unsure how to do it or want to make sure your entire website security foundation is solid, the Kartech. team in Bandar Lampung can help—from auditing your website's current state to building a security layer matched to your business scale. Reach us via our contact page or see our services.
Also read: a strategic guide to domain names and a guide to website development costs.
