Does your website need an SSL certificate?
Yes, a business website needs an SSL certificate. It (the current protocol is really called TLS, but the old name stuck) lets a browser open an encrypted connection to your website and confirms that the server really belongs to your domain. With it, your address starts with https:// and Chrome shows no warning.
Without it, anything a visitor types into a form travels in readable text, and Chrome labels the page "Not secure".
For most business websites the short answer is: you need HTTPS on every page, a free certificate does the job, and the money is better spent on setup and upkeep than on a pricier certificate. The rest of this guide explains why, and what to check if a host is pushing you to buy one.
Two jobs, one file
- Encryption: nobody on the café Wi-Fi or the network in between can read or alter what passes between the visitor and your site.
- Identity: a certificate authority has checked that whoever requested it controls the domain. It says nothing about whether the business is honest.
That second point matters. A phishing site can have a padlock too. The padlock means the connection is private, not that the company is trustworthy.
Free or paid: the real difference
All three certificate types use the same encryption. What changes is how much the certificate authority checks before issuing it. Free certificates from Let's Encrypt, which most hosts and CDNs install automatically, are domain validated (DV).
Years ago, extended validation (EV) certificates put the company name in a green bar next to the address. Major browsers removed that display, so today a visitor sees the same padlock, or a similar icon, whatever you paid. That is why we rarely recommend paying for EV for a clinic, hotel or shop website. OV or EV can still make sense when a bank, a large buyer or an internal policy explicitly requires it.
| Type | What is checked | What visitors see | Who needs it |
|---|---|---|---|
| DV (domain validated) | Control of the domain only | Padlock and https:// | Almost every business website and online store |
| OV (organisation validated) | Domain plus the legal organisation | Same padlock; details only if someone opens the certificate | Firms whose partners or policies ask for it |
| EV (extended validation) | Deeper checks on the organisation | Same padlock; the green bar is gone | Rarely needed; mainly regulated sectors with a stated requirement |
HTTPS, trust and Google
Chrome and other browsers mark plain HTTP pages as "Not secure", a change announced on the Chromium blog and now standard. On a form page the warning becomes more prominent as the visitor starts typing. For a Bangkok clinic asking for a name and phone number, that is exactly the moment you do not want doubt.
Google also said back in 2014 that HTTPS is a ranking signal, and described it as a lightweight one. Do not expect a move to HTTPS to lift rankings on its own. The real gains are indirect: fewer visitors leaving at a warning, cleaner analytics referral data, and access to modern browser features that only run on secure pages.
Where you get the certificate matters less than people think. Most good hosts issue one with a click; our guide to choosing hosting in Thailand lists this among the basics to confirm before you sign up. A CDN such as Cloudflare can also issue one at its edge. Either way, the certificate should renew by itself.
Setting HTTPS up properly
Installing the certificate is step one of five. Sites that stop there often end up with two versions of every page, one on http and one on https, which splits analytics and confuses search engines. Work through the list below, and repeat it whenever you move a website to a new host or change the domain.
HSTS deserves a note of caution. Once browsers have seen the header, they refuse plain HTTP for your domain for as long as the header says. Test everything first, start with a short duration, and only then raise it. If a subdomain still runs without a certificate, including subdomains in HSTS will break it.
- Install and cover every hostnameThe certificate must cover both yourdomain.com and www.yourdomain.com, plus any subdomain you use.
- Redirect with a 301Send every http:// address, and the non-preferred www or non-www version, to one https:// address with a permanent redirect.
- Update internal links and settingsChange the site address in WordPress or your platform settings, and replace hard-coded http:// links in menus, content and templates.
- Add HSTS carefullyThe Strict-Transport-Security header tells browsers to use HTTPS only. Start with a short max-age and raise it once all pages work.
- Tell Google and your toolsAdd the https property in Search Console, submit the sitemap and check that GA4, pixels and forms still record.
Fixing mixed content warnings
Mixed content is the most common reason a site with a valid certificate still loses its padlock. The page itself loads over HTTPS, but an image, script, font or embedded video on it is still requested over plain HTTP. Browsers block insecure scripts outright and may upgrade or flag insecure images, so you can see anything from a missing icon to a broken slider.
Finding the culprit
- Open the page in Chrome, press F12 and look at the Console tab. Mixed content errors name the exact file.
- Search your database or theme files for "http://" followed by your own domain. Old image URLs in blog posts are the usual source after a move.
- Check third-party embeds: old map codes, booking widgets and chat scripts copied years ago.
On WordPress, a proper search-and-replace of the old address fixes most of it. Plugins that rewrite URLs on the fly work, but they hide the problem rather than solve it. Take a full backup before any database replace; our guide to WordPress backups explains what a restorable backup includes.
Renewals and shorter certificate lifetimes
Certificates expire, and an expired one is worse than none: browsers show a full-page warning that most visitors will not click past. Let's Encrypt certificates have long been short-lived by design, and in 2025 the CA/Browser Forum, the industry body browsers and certificate authorities work through, approved a schedule that cuts the maximum lifetime of all public certificates in stages, down to 47 days by 2029. Paid certificates are affected too.
The practical lesson: calendar reminders and manual renewals no longer scale. Your certificate should renew automatically through your host's control panel, an ACME client on the server, or your CDN. Three checks worth making on any site:
- Auto-renewal is switched on and has already succeeded at least once.
- Renewal does not depend on a DNS record that will change if you transfer a domain to another registrar.
- Someone receives the expiry warning emails, at an inbox that is actually read.
Certificate checks belong in regular upkeep, next to updates and backups. Our website maintenance checklist puts them in a monthly routine.
HTTPS, forms and PDPA
Thailand's Personal Data Protection Act B.E. 2562 (2019) requires a data controller to put in place appropriate security measures to prevent unauthorised access to, use or disclosure of personal data (section 37). The law does not list HTTPS by name, but a contact form that sends names, phone numbers, LINE IDs or health details over plain HTTP is hard to defend as appropriate.
Encryption in transit is only one layer. Think about where the form data goes after it leaves the browser:
- Is it emailed in plain text to a shared inbox, stored in the WordPress database, or both?
- Who can log in and read it, and are old entries deleted when no longer needed?
- Do third-party scripts on the form page, such as chat widgets or trackers, receive any of it?
A clinic website or a real estate agency website collecting ID numbers or medical questions should be stricter still. HTTPS is the baseline that makes the rest possible, not a substitute for it.
Online stores and card payments
Store owners are sometimes told they need an expensive certificate to take card payments. In practice, on Shopify or a WooCommerce shop using a hosted payment gateway, the card details are entered on the gateway's own page or secure field, and the gateway carries the main burden of the card industry standard, PCI DSS. Your site still needs HTTPS everywhere, and you still have your own, smaller compliance duties, but the certificate type does not change them. PromptPay QR and bank transfer flows work the same way.
Much certificate trouble is not the certificate at all: a renewal that silently failed, a redirect loop after a theme change, a plugin loading an old http script. That is the kind of thing ongoing care after launch catches before customers do. If you are unsure what website maintenance covers, start there. We price maintenance per site on request, and our page on website maintenance cost explains what shapes the quote.
More hosting and maintenance guides
Sources
- Google Search Central: HTTPS as a ranking signal
- Let's Encrypt documentation
- CA/Browser Forum (ballot SC-081, certificate lifetimes)
- Chromium blog: A secure web is here to stay (2018)
- PCI Security Standards Council
- Personal Data Protection Committee (PDPC) Thailand: PDPA B.E. 2562
Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us