A few weeks ago I looked at a local contractor's website. Nice photos, solid work, clear phone number. And right next to the address, in plain grey text, it said Not secure.
He had no idea. Nobody had ever told him. And every single person who visited that site on their phone saw that warning before they saw a single photo of his work.
So let's talk about what that actually means, because it's one of the easiest things to fix and one of the most expensive to ignore.
The short version
HTTP and HTTPS are two ways a website talks to your visitor's browser. The S stands for secure. With plain HTTP, everything travelling between your site and the visitor goes across the internet as readable text. With HTTPS, it's encrypted, so anyone snooping on the connection just sees scrambled nonsense.
Think of HTTP as sending a postcard. Anyone who handles it can read it. HTTPS is a sealed envelope.
Why a small business should care
You might be thinking, "I don't sell anything online, who cares if my brochure site is encrypted?" Fair question. Here's why it still matters.
- Browsers call you out. Chrome, Safari, Firefox and Edge all flag HTTP sites as not secure. Some show a full page warning before the visitor can even see your content. That's a lot of trust to lose before you've said a word.
- Your contact form is collecting personal info. Names, phone numbers, email addresses, what someone needs done. On HTTP, that travels unprotected.
- Google prefers it. HTTPS has been a Google ranking signal for years. It's a small one on its own, but when two local businesses are otherwise similar, the secure one has the edge.
- It protects your visitors from tampering. On public wifi, a plain HTTP page can be altered in transit. Injected ads and sketchy redirects are real things that happen.
How to check your own site in ten seconds
Open your website on your phone or computer and look at the address bar.
- You see a padlock icon, or just a clean address with no warning. You're on HTTPS.
- You see "Not secure" or a warning triangle. You're on HTTP, or your certificate has a problem.
- You type the address starting with http:// and it doesn't jump to https:// by itself. That means your site is reachable both ways, which is also worth fixing.
Also try your site with and without the www in front. Both versions should end up at the same secure address.
The expired certificate trap
HTTPS runs on something called an SSL or TLS certificate. Those certificates expire. If nobody renews yours, visitors suddenly get a big red warning page that says the connection isn't private. It looks scary, and most people will simply leave.
This happens a lot with older sites where someone set up a paid certificate years ago and forgot about it. The renewal email went to an old address and nobody noticed until customers started calling.
What it costs to fix
Less than you'd think, often nothing. Free certificates from providers like Let's Encrypt and Cloudflare are trusted by every major browser. Paid certificates exist, but a normal small business site doesn't need one.
The part people get wrong is the move itself. Switching to HTTPS means every old HTTP link needs to redirect to the new secure one, otherwise you can split your Google rankings between two versions of the same page. It's not hard, but it needs to be done properly.
What we do at Stackwell
Every site we build runs on HTTPS from day one, with certificates that renew automatically. Nobody has to remember a renewal date, including us. If you already have a site and you're not sure where it stands, our free audit checks it in a few seconds.
And if your site is on HTTP right now, don't panic. It's one of the cleanest wins in web work. Fix it this week and the warning disappears.