HTTPS explained for business owners: what SSL actually protects

A shop owner once asked why his website had been defaced when it “had SSL”. It is a fair question, and the honest answer is that the padlock was never designed to stop that. Knowing what does SSL protect, and just as importantly what it leaves alone, helps you spend your security effort in the right places and avoid a false sense of safety.

This guide explains HTTPS in plain terms, walks through the certificate types you will be offered, and clears up the myths that hosting sales pages tend to encourage.

The short version: SSL protects data while it travels

When someone visits your site, their browser and your server exchange data across many networks: home Wi-Fi, a mobile operator, internet exchanges, your hosting provider. Without HTTPS, anyone positioned along that route could read or alter the traffic.

HTTPS wraps that exchange in encryption using a protocol called TLS. “SSL” is the older name that stuck around in marketing, but modern sites use TLS 1.2 or TLS 1.3. The certificate installed on your server lets browsers confirm they are talking to your domain and not an impostor, and it enables the encrypted session.

Three things HTTPS gives you

• Confidentiality: form entries, login passwords, cookies and page content cannot be read by someone on the same café Wi-Fi or by a compromised router.
• Integrity: nobody in the middle can quietly inject ads, swap a bank account number on your payment page or insert malicious scripts into the page on its way to the visitor.
• Authentication of the domain: the browser checks that the certificate was issued for the exact domain in the address bar by a trusted certificate authority.

What SSL does not protect

This is where most confusion lives. Encryption in transit ends the moment data arrives at your server. From there, everything depends on how the website and hosting are built and maintained.

1. Your server and database. If an attacker gets into the hosting account or exploits a vulnerable plugin, HTTPS does nothing to stop them reading stored enquiries or customer records.
2. Weak passwords and stolen logins. A guessed admin password works just as well over an encrypted connection.
3. Website code flaws. Problems such as SQL injection, cross-site scripting or insecure file uploads are carried happily through the encrypted tunnel.
4. Malware on the visitor’s device. A keylogger on a customer’s computer sees what they type before encryption happens.
5. Honesty of the business. Phishing sites obtain certificates too. A padlock proves the connection is private, not that the owner is trustworthy.
6. Emails and backups. The certificate on your website does not encrypt the email notification your contact form sends, nor the backup file sitting on a shared drive.

Think of HTTPS as a sealed, tamper-evident envelope. It keeps the letter private in the post. It does not lock the filing cabinet where the letter is stored after delivery.

DV, OV and EV certificates: what the labels mean

Certificates all provide the same strength of encryption. The difference between types is how much the certificate authority checks before issuing one.

Domain Validated (DV)

The authority only confirms that you control the domain, usually through a DNS record or a file placed on the server. Issuance is automatic and fast. Let’s Encrypt provides free DV certificates, and most hosting control panels and Cloudflare can set them up and renew them automatically. For the vast majority of small business websites, blogs and online stores, DV is entirely sufficient.

Organisation Validated (OV)

The authority also verifies that a registered organisation exists and is connected to the domain. The company name appears inside the certificate details, which a curious visitor can view, but browsers do not display it prominently. OV is common for corporate sites that want that record for procurement or compliance checklists.

Extended Validation (EV)

EV involves the most thorough checks of legal identity. Years ago browsers showed a green bar with the company name, which is why EV was sold as a trust booster. Major browsers removed that special display, so visitors now see the same padlock or connection icon as on a DV site. EV may still suit organisations with specific policy requirements, but it no longer offers a visible conversion benefit.

Wildcard and multi-domain options

These describe coverage, not validation level. A wildcard certificate covers one level of subdomains such as shop.example.in and blog.example.in. A multi-domain certificate lists several different names in one certificate. Choose based on how your domains are organised.

Common SSL myths business owners hear

“A paid certificate is more secure than a free one”

The encryption is the same. Paid certificates may include support, a warranty or OV/EV validation, but a correctly installed free certificate protects data in transit just as well.

“Only sites that take payments need HTTPS”

Any page with a login, a contact form or even just cookies benefits. Chrome and other browsers label plain HTTP pages as “Not secure”, which puts visitors off regardless of what the page does. Google has also said HTTPS is a lightweight ranking signal.

“Once installed, SSL is done”

Certificates expire. Free certificates are typically valid for 90 days and rely on auto-renewal. If renewal breaks, visitors suddenly get a full-page warning. Someone should receive the expiry alert emails and check them.

“The padlock means the site is safe to shop on”

It means the connection is encrypted. Customers still need to judge the business itself, which is why clear contact details, a physical address, GSTIN where relevant and honest policies matter.

A practical HTTPS health check for your site

You do not need technical skills to run these checks. Set aside twenty minutes:

• Open your site with http:// typed in front and confirm it jumps straight to the https:// version.
• Check both the www and non-www addresses redirect to the same secure version.
• Click the padlock or site information icon and look at the certificate’s expiry date.
• Browse your key pages, including the contact form and checkout, and look for any “Not secure” warnings.
• Open Chrome DevTools, go to the Console tab and look for “mixed content” messages, which mean some images or scripts still load over HTTP.
• Confirm who receives renewal or expiry notices, and that the mailbox is still monitored.

Where to go after the padlock

Treat HTTPS as the baseline, then spend your next hour on the risks it does not touch: strong unique passwords with two-factor authentication on admin accounts, timely software updates, regular off-site backups and limiting who has hosting access. Together these close far more doors than any certificate upgrade.

If you are unsure whether your hosting handles certificates and renewals properly, our Linux hosting plans include free SSL setup, and you can ask an expert to review your current configuration.

Frequently asked questions

Is SSL the same as TLS?

In everyday use, yes. SSL was the original protocol and has been retired because of weaknesses. TLS replaced it, but the industry still says “SSL certificate” out of habit. The certificates themselves work with TLS.

Does an SSL certificate stop hackers?

It stops people intercepting or tampering with traffic between visitors and your server. It does not stop attacks on the website itself, such as exploiting outdated plugins or guessing admin passwords.

Why does my site show “Not secure” even though I bought SSL?

Usually the certificate is installed but the site is not redirecting HTTP to HTTPS, or some pages load images and scripts over plain HTTP. Less often the certificate has expired or was issued for a different domain name.

Should a small business pay for an EV certificate?

For most small businesses, no. Browsers no longer show EV differently, so visitors will not notice. A free or low-cost DV certificate with reliable auto-renewal is the sensible choice unless a client or regulator specifically requires more.