Key Takeaways
- Google Chrome began marking HTTP pages that collect passwords or payment data as 'Not Secure' in January 2017 — with plans to extend this to all HTTP pages.
- HTTPS encrypts data transmitted between a visitor's browser and your server — protecting form submissions, login credentials, and payment data from interception.
- Free SSL certificates from Let's Encrypt are fully trusted by all major browsers and appropriate for most business websites.
- Migration requires installing the certificate, updating site URLs, setting up 301 redirects, and resolving mixed-content issues.
- HTTPS is a confirmed Google ranking signal — switching provides a real SEO benefit on top of the trust and security improvements.
In September 2016, Google's Chrome security team announced a phased plan to label all HTTP websites as 'Not Secure' in the Chrome browser. The first phase — marking HTTP pages that collect passwords or credit card data — rolled out in January 2017 with Chrome 56. Subsequent phases will extend the warning to all HTTP pages. The practical consequence for any business with a website is straightforward: visitors using Chrome now see a 'Not Secure' indicator in the address bar on your contact form, checkout, or login pages if you're still running HTTP. Research consistently links security indicators to consumer trust and purchase behaviour. A warning that says 'Not Secure' on a page where a visitor is about to enter their details is, for many, a reason to leave. The good news is that the solution is well understood, the cost for most businesses is zero, and the migration — while technical — follows a clear and repeatable process. This guide covers what SSL and HTTPS actually mean, what type of certificate your business needs, and how to make the switch without disrupting your site or search rankings.
Definition: SSL, TLS, and HTTPS
SSL (Secure Sockets Layer) is the predecessor to TLS (Transport Layer Security) — both are cryptographic protocols that encrypt data in transit between a browser and a server. 'SSL certificate' remains the common term even though modern implementations use TLS. HTTPS (HTTP Secure) is standard HTTP with an SSL/TLS encryption layer. When a site uses HTTPS, a padlock icon appears in the browser address bar and all data exchanged is encrypted. An SSL certificate is a digital document issued by a Certificate Authority (CA) that verifies the server's identity and enables encryption. Trusted CAs include Let's Encrypt (free), DigiCert, Sectigo, and GlobalSign.
Why 2017 Is the Year Every Business Has to Act on HTTPS
Google's phased rollout of 'Not Secure' warnings in Chrome makes HTTPS a basic visitor expectation — and staying on HTTP is now an active negative signal rather than a neutral choice.
The Chrome warning rollout is deliberate and escalating. Chrome 56 (January 2017) began showing 'Not Secure' on HTTP pages with password or credit card fields. Google has stated that future releases will extend the warning to all HTTP pages in incognito mode first, then to all HTTP pages regardless of mode — and that the visual treatment will grow more prominent over time, eventually resembling the red warning currently shown for known phishing sites.
For e-commerce businesses, the urgency is immediate: a 'Not Secure' label on a checkout page is conversion-killing. For service businesses with contact forms, the impact is subtler but real — visitors are becoming conditioned to expect the padlock icon, and its absence reads as a trust deficit. A 2016 GlobalSign survey found that 84% of online shoppers would abandon a purchase if data were sent over an unsecured connection.
The broader context is that HTTPS adoption has hit a tipping point. As of early 2017, more than half of pages loaded in Chrome globally are served over HTTPS. When most websites a user visits are secure, the ones that aren't begin to stand out negatively. Remaining on HTTP is no longer a neutral position — it's falling below the baseline visitors now expect.
Which SSL Certificate Does Your Business Website Actually Need?
For most business websites, a free domain-validated (DV) certificate from Let's Encrypt provides full encryption and browser trust at zero cost — the same encryption strength as certificates costing hundreds of dollars per year.
SSL certificates come in three validation tiers. Domain Validation (DV) certificates are issued after the certificate authority verifies that the applicant controls the domain — no company documentation required. Let's Encrypt issues DV certificates for free, renewing them automatically every 90 days. The encryption provided by a DV certificate is identical to that of a paid certificate; what DV certificates don't provide is verified company identity. The padlock icon looks identical for a Let's Encrypt certificate and a DigiCert premium certificate — visitors cannot tell the difference by looking at the browser.
Organisation Validation (OV) certificates require the CA to verify the legal existence and registration of the organisation before issuance. They cost $50–$200/year and include verified company details accessible to users who click the padlock and inspect the certificate. Extended Validation (EV) certificates require the most rigorous verification and — in 2017 — display a green address bar with the company name prominently shown, giving users strong visual confirmation of the company's identity. EV certificates cost $200–$400/year. Banks, financial institutions, and large retailers have historically used EV for checkout flows.
For the majority of small and medium businesses, a free Let's Encrypt DV certificate is the correct choice. The encryption is identical to paid options, browser trust is complete, and renewal is automated. Invest in OV or EV only if your business operates in a high-trust context (financial services, healthcare) where visitors actively look for company identity verification before transacting.
- Domain Validation (DV): free via Let's Encrypt, full trust, appropriate for most business websites
- Organisation Validation (OV): $50–$200/year, verifies company identity, minimal visible difference to most visitors
- Extended Validation (EV): $200–$400/year, green bar with company name in 2017, suited to financial/high-trust environments
- Wildcard: covers all subdomains — useful for businesses running multiple subdomains from one domain
- Multi-domain (SAN): covers multiple distinct domains in one certificate
How to Migrate Your Business Website from HTTP to HTTPS Without Breaking Anything
A successful HTTP-to-HTTPS migration follows five steps: install the certificate, update site URLs, set up 301 redirects, resolve mixed-content issues, and update external tools like Google Search Console and Analytics.
Start with the certificate. Most quality web hosts have integrated Let's Encrypt and provide a one-click installation through their control panel (cPanel, Site Tools, or similar). If your host does not automate this, obtain a certificate from the Let's Encrypt website and install it manually through the SSL section of your hosting control panel. Once installed, your site is reachable at https://yourdomain.com — but the HTTP version still exists as a separate, insecure copy.
Update your site's base URL to HTTPS. In WordPress, change both the WordPress Address and Site Address fields in Settings > General. For other CMSs, update the equivalent base URL setting. After this change, all internally generated links will use HTTPS. Next, scan your database and files for hardcoded HTTP references — images, scripts, and stylesheets still referenced with HTTP URLs will trigger mixed-content warnings that cause browsers to block those resources. The Really Simple SSL plugin handles most of this automatically for WordPress. Non-WordPress sites should use a find-and-replace across the database and file system.
Set up 301 redirects to forward all HTTP traffic to HTTPS. On Apache hosts, add the redirect rules to your .htaccess file. On Nginx, add them to your server block configuration. Properly implemented redirects preserve search rankings by passing link equity from HTTP URLs to their HTTPS equivalents. Finally, update Google Search Console (add and verify the HTTPS version as a new property), resubmit your sitemap with HTTPS URLs, and update your Google Analytics property to use the HTTPS URL as the default. Update any canonical tags, hreflang attributes, and structured data that contain absolute HTTP URLs.
Experience Signal
We've migrated dozens of business websites from HTTP to HTTPS, and the process has become dramatically simpler as hosting providers have integrated Let's Encrypt. The most common complication is mixed content — images uploaded before the migration that were stored in the database with absolute HTTP URLs. Better Search Replace resolves these reliably in WordPress, but it requires a database backup and careful post-migration testing. The part clients worry most about — certificate installation — is now frequently a button click. The part that requires more attention is Google Search Console: correctly setting up the HTTPS property, resubmitting sitemaps, and monitoring for any crawl anomalies in the weeks after migration.
Frequently Asked Questions
Yes, though the direct ranking boost is modest. Google confirmed HTTPS as a ranking signal in 2014. More importantly, Chrome's 'Not Secure' warning on HTTP pages — now shown for any page that collects passwords or payment data, with broader rollout planned — directly reduces visitor trust and conversion rates. The combined SEO and conversion impact makes the switch clearly worthwhile for every business website.
Free to several hundred dollars per year, depending on certificate type. Let's Encrypt issues free domain-validated (DV) certificates that are fully trusted by all major browsers and provide identical encryption to paid certificates. Most quality web hosts now include Let's Encrypt and install it with a single click. Paid organisation-validated (OV) or extended-validation (EV) certificates add verified company identity and cost $50–$400/year — rarely necessary for small or medium businesses.
Not if done carefully. The main risk is 'mixed content' — page resources (images, CSS, scripts) that still load over HTTP after the main URL becomes HTTPS. Browsers block or warn about mixed content, which can cause images or styles to break. Fix this by updating all internal links and resource references to HTTPS or protocol-relative URLs, then set up 301 redirects from every HTTP URL to its HTTPS equivalent to preserve search rankings and external links.
Sources
Need Help Migrating Your Website to HTTPS?
Webnixon handles SSL installation, 301 redirect configuration, mixed-content resolution, and Search Console reconfiguration for business websites. We make sure the migration is clean, complete, and doesn't cost you rankings.
Get a Migration QuoteAbout the author
Jai Paek
Creative Director
Jai leads brand identity and UX design at Webnixon, bringing 20+ years of experience building digital design systems for agencies and enterprise teams. He has shipped design systems and visual identities for over 200 brands across Canada and the US, with deep expertise in conversion-focused UI, WCAG 2.1 accessibility compliance, and responsive web design for service businesses and ecommerce brands.
Related Articles
Web Design
Website Accessibility Basics: What Ontario Businesses Need to Know About AODA
Ontario's Accessibility for Ontarians with Disabilities Act has digital requirements that affect many Ontario businesses — and the compliance deadlines have either passed or are approaching. This practical guide explains what AODA requires for websites, what WCAG 2.0 Level AA actually means in practice, and where Ontario businesses should start.
Web Design
How to Improve Website Page Speed: A Practical Guide for Ontario Businesses
Every extra second your website takes to load, you lose visitors. Studies show a one-second delay in page load time reduces conversions by 7%. This guide walks through the specific fixes that will make the biggest difference for a typical Ontario small business website.
SEO
5 Reasons Your Business Isn't Showing Up on Google (And How to Fix It)
If your business isn't showing up when customers search for what you offer, you're missing out on real revenue. Most of the reasons are fixable — and you don't need to be a tech expert to address them.