Does Your Small Business Website Need HTTPS?

By Bill Stilwell · Last reviewed October 16, 2026

The short answer

Yes. Every business website should use HTTPS on every page. It encrypts what visitors send you, like contact form details, so others can’t read it along the way. Google said that with Chrome version 154, released in October 2026, Chrome would start asking people for permission before they open a public site that doesn’t use HTTPS.

What this means

HTTPS stands for Hypertext Transfer Protocol Secure. It’s the secure version of the way browsers and websites talk. When it’s working, your web address starts with “https://” and the browser shows the connection is secure.

It works through a certificate on your site. People often call it an SSL certificate, after Secure Sockets Layer (SSL), the older name for the technology. The current technology is Transport Layer Security (TLS), but most hosts still use the old name.

Many hosts include a certificate for free and renew it on their own. Some charge for it or make you install it.

Say a plumber’s website still loads at “http://” with no certificate. A homeowner clicks the link from Google Maps and sees a browser warning first. Many people stop there and call someone else.

Why it matters

Visitors see warnings. Browsers flag sites that aren’t secure. With Chrome’s new default, people get a warning page before they reach many sites without HTTPS.
Form details are exposed. Without encryption, names, phone numbers, and messages sent through your forms can be read in transit. The Federal Trade Commission (FTC) says encryption matters most when you collect passwords or payment details.
Google looks at it. Google’s page experience guidance asks whether your pages are served securely. Google says there’s no single page experience signal, so HTTPS alone won’t lift your rankings, but it’s part of a good experience.
Some features need it. Many modern website tools, payment tools, and forms won’t work right without a secure connection.

Who this applies to

Every business website. There’s no type of business that can skip it. Even a one-page site with just a phone number should use HTTPS.

How to do it

Check your site now. Open it in a browser and type “http://” in front of your domain. See whether it switches to “https://” on its own.
Ask your host if a certificate is included, and whether it renews on its own (see 13.2.1 Website Hosting). The FTC suggests asking whether it’s free or a paid add-on, and who sets it up.
Turn it on in your hosting or website builder settings. Many builders do this for you.
Send all visitors to HTTPS. Set up a permanent redirect from every “http://” address to the matching “https://” address. This keeps old links and bookmarks working (see 19.5.6 Broken Links and Redirects).
Fix “mixed content.” That’s when a secure page loads an image or file from an “http://” address. Browsers may block it or show a warning. Update those links.
Update your links everywhere. Use the “https://” version on your Google Business Profile (GBP), social profiles, directories, and email signature.
Check Google Search Console. It has an HTTPS report that shows pages Google couldn’t load securely and what to fix.
Watch the expiration date. Certificates expire. If yours doesn’t renew on its own, put the date on your calendar and set up uptime alerts that catch certificate errors (see 13.2.6 Uptime Monitoring).

What proof to keep

A screenshot of your site with the secure connection showing
The certificate’s expiration date, or a note that the host renews it on its own
A screenshot of the Search Console HTTPS report

Store these in your website records folder.

Common mistakes

Turning on HTTPS but not redirecting. Both versions of the site stay live. Visitors and search engines may land on the insecure one.
Letting the certificate expire. Visitors see a full-page error. Auto-renewal can fail if your Domain Name System (DNS) settings changed (see 13.1.4 DNS Access).
Only securing the home page. Every page needs it, especially forms.
Forgetting “www” or extra domains. Make sure both “www” and the bare domain have a certificate and redirect correctly.
Old “http://” links on listings. They still work if you redirect, but update them so customers go straight to the secure page.

When to get help from a pro

A web professional: if your site shows “not secure” after you turned on a certificate, or if moving to HTTPS broke pages. Ask:

Are all old addresses redirecting to the right new ones?
Is any content still loading over “http://”?
Does the certificate renew on its own, and will I be alerted if it fails?

Bill’s note

[Bill: add a short story or lesson here. For example, a local business site you found with an expired certificate, or what happened to calls after a site was moved to HTTPS.]

If you’d rather have this done for you, SiteSmarty builds and hosts secure websites for local businesses.

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: how HTTPS was set up on SiteSmarty’s site and how redirects were checked]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: Chrome’s secure connection details and the Search Console HTTPS report]
[Result so far:]

Questions people ask

Why does my website say “not secure”? It’s loading without HTTPS, the certificate expired, or some content on the page loads over an insecure link.

Does HTTPS help my Google rankings? Google lists secure pages as part of good page experience. It says no single signal decides rankings, so don’t expect HTTPS alone to move you up.

Is an SSL certificate the same as HTTPS? The certificate is what makes HTTPS work. “SSL” is the old name people still use.

Do certificates expire? Yes. Many hosts renew them on their own. Check yours so a lapse doesn’t surprise you.

Audit check

Question: Does every page of the website load over HTTPS, with all HTTP addresses redirecting to it?
Pass looks like: Every page shows a secure connection. “http://” and non “www” versions redirect to one secure version. No mixed content warnings. Certificate renews on its own or the date is tracked. Listings use the “https://” link.
Fail looks like: “Not secure” warning. Expired certificate. Both HTTP and HTTPS versions live. Forms on insecure pages.
Evidence to collect: Screenshots of the secure connection, the redirect test, the Search Console HTTPS report, and the certificate renewal setting.

Where this fits

Do this first: 13.2.1 Website Hosting, 13.1.4 DNS Access

Do this next: 13.2.3 Staging and Production Sites

Sources

Google Security Blog, "HTTPS by default" (checked October 16, 2026)
Google Search Central, "Understanding page experience in Google Search results" (checked October 16, 2026)
Federal Trade Commission, "Cybersecurity for small business: Hiring a web host" (checked October 16, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.