What Is an SSL Certificate and Which Type Do You Need?

That little padlock in your browser’s address bar is the work of an SSL certificate. It encrypts the connection between your website and your visitors, so passwords, payment details and personal information stay private on their way across the internet.

Beyond security, an SSL certificate builds trust and helps your search rankings — browsers now flag sites without one as “not secure”. Here is what you need to know.

What an SSL certificate actually does

• Encrypts data so it cannot be read if intercepted.
• Verifies that your visitors are connecting to the real you, not an imposter.
• Enables HTTPS and the padlock, which reassures customers.

The main types of SSL certificate

Domain Validation (DV)

The quickest and most common. It confirms you control the domain and issues in minutes. Free Let’s Encrypt certificates are DV — perfect for blogs, brochure sites and most small businesses.

Organization Validation (OV)

Adds a check of your business details, offering a bit more assurance. A good fit for company and ecommerce sites.

Extended Validation (EV)

The most thorough vetting, historically used by banks and large retailers that want the highest level of demonstrated trust.

Wildcard and multi-domain

A wildcard certificate secures a domain and all its subdomains at once. A multi-domain certificate covers several different domains on one certificate.

Which one do you need?

For most websites, a free DV certificate is all you need — and you can install one right now by following installing a Let’s Encrypt SSL certificate from cPanel. If you run a large store or need business validation, an OV, EV or wildcard certificate may be worth it.

Frequently asked questions

Is a free SSL certificate as secure as a paid one?

Yes — the encryption is identical. Paid certificates differ in the level of identity validation and support, not the strength of the security.

How do I turn on SSL for WordPress?

After installing the certificate, follow enabling SSL on your WordPress dashboard, then fix any mixed content warnings.

My site has a certificate but still shows “not secure”.

That is usually mixed content or a missing redirect. Force HTTPS with the force HTTPS redirect guide.