SSL certificates and HTTPS, explained for business owners
An SSL certificate is what lets a website load over HTTPS, the padlock version of a web address. Without one, browsers warn visitors, and forms send what people type without encryption. Here is how it works and what it means for a South African business.
What visitors see without one
Chrome's own help page explains the warnings it shows.
"Not secure"
Chrome's help page says a "Not secure" site connection is not private, and someone can find the information you send or get through the site.
"Your connection to this site is not secure"
When Chrome's "Always use secure connections" setting is on and a site does not support HTTPS, Chrome shows this warning before the page opens.
Who has to fix it
Chrome tells visitors the site owner must secure the site with HTTPS. Nothing the visitor does removes the warning.
How a certificate is issued
The steps web.dev describes for setting up HTTPS on a server.
Create a key pair
Generate a public and private key; web.dev's guide uses a 2,048-bit RSA key pair.
Make a signing request
Generate a certificate signing request (CSR) that contains your public key.
Send it to a Certificate Authority
The Certificate Authority checks the request and returns the certificate or certificate chain.
Install and renew
Install the certificate on the server, then keep it renewed. Let's Encrypt says many hosting providers get and manage its certificates for their customers automatically.
Why Google cares
HTTPS is part of how Google assesses page experience.
Google asks site owners to assess whether pages are secure (HTTPS), alongside Core Web Vitals and mobile-friendliness.
Google says page experience is evaluated per page, so every page needs HTTPS, not only the home page.
Search Console's HTTPS report shows whether you serve secure HTTPS pages and what to fix if not.
HTTPS and South African law
Neither POPIA nor ECTA names SSL. Both require security, and HTTPS is the usual first step.
What the law says
- POPIA s19: appropriate, reasonable technical and organisational measures
- POPIA s19: prevent unlawful access to personal information
- ECTA s43(5): a payment system sufficiently secure by accepted technological standards
- ECTA s43(1)(p): show your security procedures and privacy policy
How HTTPS helps
- Form entries are encrypted between the visitor's browser and your server
- Checkout and login pages stop showing browser warnings
- Payment pages meet the accepted standard browsers expect
- You can describe it in your security and privacy notice
Every site we host includes HTTPS: see web hosting or hosting in East London. The POPIA guide covers the rest of section 19.
Check your own site in five minutes
You do not need technical skills for these checks.
- Type your address with http:// and confirm it moves to https://Browser check
- Open your contact page and look for the padlock, not "Not secure"Chrome help
- Open a few inner pages too: page experience is per pageGoogle page experience
- Look at the HTTPS report in Search ConsoleSearch Console
- Ask your host who renews the certificate and whenLet's Encrypt
Questions people ask
What is the difference between SSL and HTTPS?
HTTPS is the secure version of a web address. An SSL certificate (technically a TLS certificate today) is what the server uses to set up that secure connection.
Do I need an SSL certificate if I do not sell anything?
Yes. Chrome warns visitors on sites without HTTPS, contact forms send personal information that POPIA section 19 requires you to protect, and Google lists HTTPS among the page experience aspects it considers.
Are free SSL certificates good enough?
Let's Encrypt issues certificates through an automated process, and many hosting providers get and manage them for customers. For a business website, what matters is that every page loads over HTTPS and the certificate is renewed automatically.
Why does my site still say "Not secure" after installing a certificate?
Usually because some pages, or images and scripts on them, still load over http://. Google evaluates page experience per page, so every page and its files need to load over HTTPS.
Sources
Every statement above comes from these pages, read on 15 November 2026. This guide explains the rules in plain language; it is not legal or tax advice for your particular business.
- Google Chrome HelpCheck if a site's connection is secure
- web.devEnable HTTPS on your servers
- Let's EncryptGetting started
- Google Search CentralUnderstanding page experience in Google Search results
- POPIASection 19: security measures
- ECTASection 43: information to be provided
Related on this site
Want this handled for you?
What the padlock means, how certificates are issued and why Google and the law care. Tell us about your business and we reply with a fixed price.