SSL and the Padlock: What It Says About Your Business

Look at your browser's address bar right now. There's a small padlock there, and most visitors couldn't explain what it means. They only know what its absence means. An SSL certificate is the thing that earns your website that padlock, and when it's missing, Chrome writes "Not Secure" next to your business name in plain text. For a customer deciding whether to type their phone number, their card details or their eSewa credentials into your site, that one phrase does more damage than a bad review.

What an SSL certificate actually does

Technically, SSL (these days TLS, but everyone still says SSL) encrypts the connection between a visitor's browser and your server. Without it, anything typed into your site travels as readable text: passwords, card numbers, contact forms. On public WiFi in a Thamel cafe, that traffic can be read by anyone bothered to look. With SSL, it's scrambled. That's the whole mechanism, and it takes effect the moment your site loads over https instead of http.

What visitors think it means

Here's the commercial reality: visitors don't evaluate encryption. They evaluate signals. A padlock reads as "real business". A "Not Secure" warning reads as "scam", even on a perfectly honest site that just never got around to installing a certificate. We've measured this with clients: one Kathmandu retailer saw contact form submissions jump noticeably in the month after we moved them to https. Nothing else changed. Same products, same prices, one less warning.

Google notices too

HTTPS has been a Google ranking signal since 2014. It's a small signal, but you're competing against sites that all have it, so missing it only hurts. More practically, Chrome and Safari actively discourage users from submitting forms on http pages, and some browsers interrupt with a full-page warning. Every one of those interruptions is a customer you paid to attract, through ads or SEO or word of mouth, being told to leave.

SSL certificates expire, and browsers do not forgive

Certificates are issued for fixed periods, often 90 days for free certificates. When one lapses, browsers don't show a gentle notice. They show a full-screen red warning that says the connection is not private and advises visitors to go back. Overnight, your website becomes a security incident in your customers' eyes. The fix is renewal, ideally automated. Any decent host auto-renews certificates silently; if yours makes you do it manually, that's a hosting review waiting to happen.

Do you need to pay for SSL?

For most business websites: no. Free certificates from Let's Encrypt provide the identical encryption and the identical padlock as certificates costing USD 50 to 200 a year. Paid certificates mainly add warranties and validation levels that matter for banks and large e-commerce operations. If a provider is charging you yearly for a basic SSL certificate as a line item, you're buying bottled water beside a public tap. Every hosting plan at WebsNP includes free SSL, installed and auto-renewed, because charging for it in 2026 feels faintly embarrassing.

The one gotcha: mixed content

Sometimes a site has SSL but still shows no padlock. The usual cause is mixed content: the page is https, but one old image or script still loads over http, and the browser downgrades the whole page's status. It's a ten-minute fix for a developer, and worth doing, because a partly secure page sends the same "Not Secure" signal you paid to remove.

Every website WebsNP designs launches with SSL configured from day one: free certificate, https everywhere, redirects handled, no mixed content. It's part of every design package alongside the free domain and first year of NVMe hosting. The padlock is the cheapest trust signal your business will ever acquire. There's no good reason to be the shop on the street with the broken lock on the door.