In late 2026, millions of websites will suddenly get a red flag in the browser — and their owners will hear about it from confused customers rather than from any dashboard. The reason will be the same in almost every case: a missing or misconfigured SSL certificate.
Google has already confirmed that with Chrome 154, which becomes the default for all users in October 2026, the browser will ask for confirmation before opening any public site that does not support HTTPS. Earlier, from Chrome 147 in April 2026, this was switched on for over a billion users with Enhanced Safe Browsing. So the “this site is not secure” screen is about to be seen not by a technician in the settings menu, but by an ordinary visitor — a second before they decide not to buy from you after all.
Let’s break it down without jargon: what this certificate actually is, what it really does, how much it costs (often nothing) and how to tell when something is wrong with yours.
When a visitor fills in a form on your site — name, phone number, card details — that data travels from their device to your server through dozens of intermediate points. Without encryption, anyone along that path, from the admin of a café’s public Wi-Fi to an internet provider, can read it in plain text.
An SSL certificate (technically TLS now, but the old name stuck) does two things. It encrypts that stream, turning the data into an unreadable set of characters for everyone except the destination server. And it confirms that the site the visitor opened really is yours, not a phishing copy that stole your design and logo.
Technically, the certificate is a small file issued by a trusted Certificate Authority and installed on the server. During the connection, the browser checks that file: who issued it, to whom, whether it has expired, whether it has been revoked. If everything checks out, you get the padlock and an https:// address. If not, a warning.
The key word here is “trusted.” Browsers keep a list of certificate authorities they trust by default. A certificate from such an authority is accepted silently; one you generated for yourself is not, even if the encryption underneath is technically identical. So the whole point of SSL is not only the maths of encryption but also the chain of trust: someone authoritative vouches that the site at this address is genuinely who it claims to be.
The difference between http:// and https:// is literally that trailing “s” for “secure.” But the consequences of that letter are visible to the visitor straight away.
On a secure site there is a neutral padlock next to the address. On an insecure one, Chrome has long shown a grey “Not secure” label, and soon it will show a full-screen warning with a confirmation button. Picture someone clicking your Instagram ad and, instead of the product page, hitting a screen that reads “Attackers might be trying to steal your information.” How many of them press “Continue anyway”?
At Netloria we have more than once watched a business owner blame a drop in leads on “the season” or “the algorithm” for weeks, while the cause sat right there in the address bar — the site served content over HTTP, and half of the visitors turned around at the very first screen.
A decade ago, encryption was considered necessary only for banks and online stores. Now it is the standard for the entire web, and the numbers confirm it. According to Google, the share of pages loaded over HTTPS in Chrome grew from roughly 30–45% in 2015 to around 95–99% by 2020 — and has held at that level since. On Windows it is about 95%, on Android and Mac over 99%, on ChromeOS close to 100%.
So a site without HTTPS today is that rare exception the browser deliberately draws attention to. And three separate reasons to switch are at work here, not one.
Visitor trust. The padlock and a clean address are things people have learned to notice, mostly without thinking. A “Not secure” label on a checkout page kills conversion more effectively than any typo in your copy.
Search rankings. Google has officially used HTTPS as a ranking signal since 2014. On its own it is a light one — moving to HTTPS will not rocket you to the top. But all else being equal, a secure site has an edge over an insecure competitor, and that is exactly the position most small businesses find themselves in on the results page.
Technical capabilities. Many modern browser features — geolocation, push notifications, service workers for offline mode, correct behaviour of payment forms — simply refuse to work over an unencrypted connection. Without HTTPS you are cutting off part of your toolkit before you have even thought of using it.
When it comes to choosing, it turns out that “SSL certificate” is not one product but three levels of validation. They differ not in the strength of encryption — that is the same — but in what exactly the authority checks before issuing.
| Type | What is verified | Issuing speed | Who it suits |
|---|---|---|---|
| DV (Domain Validation) | Only that you control the domain | Minutes, automatic | Blogs, landing pages, most small-business sites |
| OV (Organization Validation) | Domain plus the real existence of the company | Hours to a few days | Corporate sites where legal transparency matters |
| EV (Extended Validation) | In-depth organisation check under a strict procedure | Several days, with documents | Banks, large stores, fintech |
Here is a detail that sellers of expensive certificates stay quiet about: EV once showed a green bar with the company name in the address, and that was precisely how it was sold. Modern browsers have removed that green bar. To a visitor, DV, OV and EV now look identical — the same padlock. So paying extra for EV only makes sense where there are real regulatory or internal requirements, not for a “trust effect” the user no longer sees.
Another question where businesses lose money for no reason. SSL is often sold as a separate paid service for a few hundred a year — even though in the vast majority of cases it is already free.
The non-profit authority Let’s Encrypt issues DV certificates for free, automatically, to anyone. They are valid for 90 days and renew themselves, with no human involved. A huge share of the modern web runs on Let’s Encrypt.
In practice this means the following.
As a web studio based in Ukraine, Netloria sets up a free certificate with automatic renewal by default on every project — so the client never has to think about this technical detail and never gets a surprise a year later in the form of an expired term.
Having a certificate does not mean everything works. Here are the most common problems that make the padlock disappear or start scaring visitors with warnings. Run through this list on your own site right now.
http://. The browser treats such a page as not fully secure and drops the padlock. A classic trap after migrating an old site to HTTPS.example.com, but the visitor arrives at www.example.com — and sees an error, because to the browser these are different addresses.Mixed content is the sneakiest of these, because the site looks almost healthy. Here is a typical scenario from our practice: a business migrates an old site to HTTPS, the home page gets its padlock, everyone relaxes — and a week later they happen to notice the product pages have no padlock, because dozens of images uploaded years ago still carry http:// addresses. Each of those references has to be hunted down in the database and rewritten — sometimes it is hardcoded in the theme, sometimes in the post text, sometimes in a third-party plugin that inserts the full path. That is why we never consider an HTTPS migration finished until we have walked every internal page, not just the home page.
A trivial thing? Not to the browser. The padlock is either honest across the whole page, or it is not there at all.
A basic check takes half a minute: open the site, click the padlock next to the address, look at the expiry date and who the certificate was issued to. If there is no padlock or it is crossed out, deal with it today rather than after Chrome’s October update. And click through a few internal pages too, not only the home page — that is where mixed content hides.
The order of action depends on the state your site is in.
If there is no HTTPS at all, start with the hosting: in most panels a free certificate switches on with one click, after which you need to redirect all HTTP traffic to HTTPS and check the site for mixed content. If the certificate is there but the padlock is unstable, the problem is almost always one of the checklist items above, and it is fixed point by point.
A separate situation is when the browser warning appears suddenly after the site has worked fine for a long time. That can be more than an expired certificate — it can be a sign of a hack or tampered settings. What to do in that case we covered in detail in website hacked: what to do. And one adjacent point: the certificate is tied to the domain, so there are pitfalls when choosing that too — more on them in how to choose a domain name.
SSL is one of those cases where the correct setup costs nothing and half an hour of work, while a mistake can quietly drain leads for weeks. It stings to lose customers over a technical detail you did not even suspect existed.
If you would rather not wrestle with certificate types, redirects and mixed content — that is fine, that is what we are for. Netloria builds corporate websites with correctly configured HTTPS, automatic certificate renewal and a check against every trap listed above — so you can think about customers, not the padlock in the browser. Write to us and we will look at the state your site is in right now.
