An SSL certificate is a digital certificate installed on a web server that encrypts data between a visitor and a website and proves the site belongs to its domain. It is what changes a website address from http to https and shows the padlock in the browser, and modern certificates technically use the TLS protocol.
Why it matters for an Indian small business
Without SSL, Chrome marks your site Not Secure next to the address bar, which is the first thing a customer sees on a phone. Google has used HTTPS as a ranking signal since 2014, and any page that collects a phone number, an enquiry form or a UPI payment needs encryption to meet basic expectations under India's DPDP Act and payment gateway terms. Razorpay, PhonePe and Cashfree will not approve a checkout on a plain http page.
Price should not be a reason to skip it. Let's Encrypt certificates are free and renew automatically; paid certificates from ₹1,000 to ₹15,000 a year add warranty cover and organisation validation but no extra encryption. For most Indian small businesses a free, auto-renewed certificate is the correct choice.
How it works
When a browser connects to an https site, the server sends its certificate. The browser checks that it was issued by a trusted certificate authority, matches the domain, and has not expired. The two then agree on an encryption key and all further traffic is scrambled, so a customer on café Wi-Fi in Bengaluru cannot have their phone number or card details read in transit.
Certificates come in three validation levels: domain validated (DV, proves you control the domain), organisation validated (OV) and extended validation (EV). DV is issued in minutes and is what nearly every small business site uses. Certificates expire, so the server must renew them; automated renewal via the ACME protocol is standard on good hosting.
Example: a Chennai physiotherapy clinic
Anna Nagar Physio Care takes appointment bookings through a form that asks for name, phone and a brief description of the injury. On the old http site, Chrome showed Not Secure and the receptionist noticed patients phoning instead of filling the form. After moving to hosting with a free Let's Encrypt certificate, the padlock appears, the form submissions double, and the clinic adds a ₹300 advance via UPI to cut no-shows, which the payment gateway only allowed once the page was https. The certificate renews itself every 90 days with no one at the clinic noticing.
Common mistakes
- Buying an expensive certificate when a free one offers identical encryption.
- Installing SSL but leaving the http version live without a redirect, so Google sees two sites.
- Mixed content: an https page loading an image or script over http, which still triggers browser warnings.
- Letting a manually installed certificate expire, which shows a full-page error to every visitor.
- Collecting enquiries or payments on a page that was never secured.
How Neweb handles it
Every Neweb site is served over HTTPS with a certificate issued and renewed automatically, including for domains you bring. HTTP requests are redirected to HTTPS, and the site is checked for mixed content so the padlock stays intact on every page.
SSL Certificate questions
Is SSL free?
Yes, domain-validated certificates from Let's Encrypt are free and are what most hosts and builders install automatically. Paid certificates add warranty and organisation checks, not stronger encryption.
What is the difference between SSL and TLS?
TLS is the modern version of the SSL protocol. People still say SSL certificate out of habit; the certificate you install today uses TLS 1.2 or 1.3.
Does SSL help SEO?
HTTPS is a confirmed, lightweight Google ranking signal, and the absence of it hurts conversions because of browser warnings. It is a prerequisite rather than a growth lever.
Do I need SSL if I only have a brochure site?
Yes. Browsers warn on every http page regardless of content, and your contact form or WhatsApp click still carries data. There is no good reason to run a site without it in 2026.
How do I know if my site has SSL?
Open it in a browser and look for the padlock and https in the address bar. Click the padlock to see the issuer and expiry date.
Related terms.
Related pages.
Website security basics
SSL, backups, passwords and the DPDP Act for small sites.
Website speed test
Check that your https site loads fast on mobile.
Trust signals on your website
The padlock is one of ten signals that make visitors call.
Accept UPI payments on your website
Why gateways require https before enabling checkout.
Handle it for you? From ₹249/month.
Website, free domain, Google Business Profile, SEO autopilot and WhatsApp buttons, set up for your business by Neweb.