SSL and Basic Website Security: What It Protects and What It Doesn't

There's a widespread confusion worth clearing up immediately: an SSL certificate doesn't protect your website. It protects the route between your website and the visitor. It's the difference between a sealed envelope and a house alarm — the envelope stops people reading the letter in transit, but it doesn't stop anyone entering the house.

Conflating the two is what produces sites with a green padlock and a back door that's been open for eight months. This article separates them and explains what to do about each.

What SSL actually does

When someone types their name and phone number into your form, that data travels through a chain of machines before reaching you. Without encryption, anyone along that route — the café wifi, the internet provider, someone on the same network — can read it. SSL turns that into unreadable noise.

• It does: encrypt what's sent and received between the browser and your server.
• It does: confirm the domain you're connecting to is the one it claims to be.
• It doesn't: stop someone getting into your admin panel by guessing the password.
• It doesn't: protect against an outdated plugin with a known vulnerability.
• It doesn't: make your site "clean": an infected site can carry a perfectly valid padlock.

Free or paid? Free, nearly always

There's an industry selling expensive certificates, and for 95% of businesses they add nothing. The encryption on a free certificate is exactly as strong as on a 200-dollar-a-year one — the difference isn't security, it's the level of verification of the company behind the domain.

The error that leaves the padlock half-done

You install the certificate, the site loads over HTTPS, and the browser still doesn't show the padlock — or shows it with a warning. It's nearly always the same thing: mixed content. Some image, font or script is still loading over HTTP, and that breaks the guarantee for the whole page.

The fix is checking that every resource points at HTTPS and forcing an HTTP-to-HTTPS redirect across the domain. It's a one-off job, and worth rechecking after any major change — it's one of those errors that reappears on its own.

What genuinely stops you being hacked

Here's the useful part. Almost no small site is attacked by a person who chose it: it's attacked by automated programs sweeping the internet, testing known vulnerabilities across millions of sites. You don't have to be interesting to be broken into; being out of date is enough.

1. 01Keep everything updated. CMS, plugins, themes, language version. Most attacks exploit flaws patched months ago.
2. 02Long, unique passwords, in a password manager. Not "Company2024!", which is guessed in seconds.
3. 03Two-factor authentication on the admin panel, the hosting and the domain. The single most effective measure.
4. 04Remove what you don't use. Every deactivated plugin and every old user account is a door that still exists.
5. 05Users with minimum permissions. Someone who only writes articles doesn't need to install software.

And a sixth, which isn't prevention but a safety net: tested backups. When something does go wrong, it's the only thing that returns you to normal in hours rather than weeks. Covered in website backups.

A good share of your security is decided by the hosting

It's the least-discussed factor when choosing a plan and one of the heaviest. On cheap shared hosting you share a server with hundreds of sites, and a neighbour's infection can reach you. Managed hosting, by contrast, usually applies updates, filters malicious traffic and isolates accounts.

That doesn't mean you must buy the most expensive option: it means plan price and protection level are related, and it's worth knowing what you're buying. The real differences are in shared, VPS or managed hosting.

How to tell you already have a problem

A compromised site rarely looks broken: profitable attacks are discreet, because the longer they go unnoticed, the longer they work. These are the signals that usually appear first.

• A Google warning in search results or in Search Console. The most serious signal, and the latest to arrive.
• Odd redirects, especially on mobile or from search results, but not when typing the address directly.
• Pages you didn't create showing up indexed, usually in languages you don't publish in.
• Admin users you don't recognise, or logins at impossible hours.
• The site suddenly crawling, with no rise in legitimate traffic.

What being reasonably protected costs

Less than people fear. The certificate is usually free and automatic; two-factor costs nothing; staying updated is time, not money. The only real spend is decent hosting and, if the site is critical, a maintenance plan that handles the updates.

Set against rebuilding an infected site, recovering rankings after a malware warning, and explaining to your customers what happened to their data, it's among the cheapest investments there is. The general framework is in how much a professional website costs.