Do I need to pay for an SSL certificate?

The short answer

Usually not. SSL (the padlock and “https” in the address bar) comes free with almost every website builder and host, mostly through Let’s Encrypt. A paid certificate rarely adds anything for a small business website. If you’re being charged for one, check your site already shows the padlock before cancelling it.

SSL, now properly called TLS, encrypts the connection between your visitors and your website. Browsers mark sites without it as “Not secure”, so you need it — but you rarely need to pay for it.

  • Website builders such as Squarespace, Wix and Shopify include SSL with every plan.
  • Most hosts install free Let’s Encrypt certificates and renew them automatically.
  • Paid certificates (OV and EV) show the same padlock to visitors. They’re mainly for organisations with specific contract or compliance requirements.

Certificates now expire faster

Certificate issuedLongest it can last
Before 15 March 2026398 days
From 15 March 2026200 days
From 15 March 2027100 days
From 15 March 202947 days

So automatic renewal by your host matters far more than who issues the certificate. Let’s Encrypt stopped sending expiry reminder emails on 4 June 2025, so don’t count on an email to warn you either.

Step-by-step example: stop paying GoDaddy for an SSL certificate.

Words used here

SSL/TLS certificate (the padlock)
What makes your site load with https:// and a padlock. Standard certificates are free and usually added automatically by your host.
HTTPS
The secure version of a web address. Visitors’ data is scrambled on its way to your site, and browsers warn people away from sites without it.
Paying for SSL
Standard SSL certificates are free (Let’s Encrypt), and hosts like Cloudflare, Vercel, Netlify and Squarespace add them automatically. Paying for one is usually wasted money.

Still have a question?

Ask the SlopDox assistant: it answers from this catalog, any time. Or let SlopDox keep track of your websites for you, free for up to 3 websites.

Start free