An SSL certificate (technically TLS today) is a digital file that proves your site's identity and encrypts the connection with visitors, so your URL shows HTTPS and a padlock. Without it, browsers show a Not secure warning, payment gateways and Apple Pay will not work, and trust and search visibility suffer. Most sites only need a free domain-validated (DV) certificate that renews automatically; your job is to connect the domain correctly and redirect everything to HTTPS.
- what is an ssl certificate
- how to make my website https
- website says not secure how to fix
- is ssl certificate free
- difference between http and https
What is an SSL certificate, and what does HTTPS mean?
An SSL certificate is a small digital file installed on the server that hosts your website or app. It does two jobs: it proves to the browser that this site really controls the domain in the address bar, and it encrypts everything sent between the visitor and the site. When it works, your URL starts with HTTPS instead of HTTP and the browser shows a padlock.
Picture a customer sending their phone number, verification code and address over café Wi-Fi. Without encryption, anyone on that network could read it like an open postcard. With HTTPS, the data travels like a sealed envelope only your site can open.
A side note: the familiar name SSL is old, and the protocol actually used today is called TLS. Hosting providers and marketers alike still say SSL certificate, so do not worry when you see both names; they mean the same thing.
The padlock is a small promise to your customer: what you type here reaches only us.
Why does your business need HTTPS?
- Payments will not work without it: payment gateways and Apple Pay require HTTPS pages. You cannot accept mada, cards, Tabby or Tamara on an unencrypted page.
- The Not secure warning: modern browsers clearly flag pages that collect data over HTTP, which is enough for a customer to close the tab.
- Trust: Gulf customers are wary of suspicious links because of scam messages, and the padlock is one of the basic trust signals.
- Search: Google said years ago that HTTPS is a lightweight ranking signal, and, more importantly, insecure pages lose visitors fast. See the Arabic SEO guide.
- Modern features: progressive web apps (PWA), notifications, location and camera access all need HTTPS in browsers.
- Personal data protection: encrypting data in transit is one of the basic safeguards expected of anyone collecting personal data.
Think about it from the customer side: they neither know nor care what TLS is, but they instantly notice Not secure next to your store name, especially on a phone where the warning stands out. At the moment of payment, any hint of doubt is enough to abandon the cart.
Types of SSL certificates: which one do you need?
| Type | What it proves | Good for | Notes |
|---|---|---|---|
| Domain validated (DV) | That you control the domain | Most stores, apps and websites | Issued in minutes, available free from well-known issuers such as Let's Encrypt, renews automatically |
| Organization validated (OV) | Domain plus the company's legal existence | Some enterprise buyers and contracts that require it | Needs documents and more time |
| Extended validation (EV) | Deeper company verification | Special requirements of some organizations | Modern browsers no longer show the company name in the address bar as they once did |
| Wildcard | The domain and all its subdomains | Anyone with many subdomains | Convenient, but protect its key carefully |
The practical takeaway: for a store, booking app or small company site, a DV certificate is entirely enough, and its encryption is as strong as the pricier types. The difference between types is how thoroughly the company's identity is checked, not how well the connection is protected. If an enterprise customer or government body asks for a specific type, follow their written requirement.
How to enable HTTPS on your domain, step by step
- 1Point the domain at your hosting
Add the DNS records your platform gives you at your registrar. Details in how to connect a custom domain.
- 2Wait for propagation
DNS updates can take minutes to hours. Do not keep changing records while you wait.
- 3Let the platform issue the certificate
Modern platforms issue a DV certificate automatically once the domain points to them, and renew it before expiry.
- 4Cover both versions
Make sure the domain with and without www both work over HTTPS, and that one redirects to the other.
- 5Redirect all HTTP to HTTPS
Turn on a permanent redirect, and consider HSTS, which tells browsers to always use a secure connection, once you are sure everything works.
- 6Test on phone and computer
Open the home page, the checkout page and the admin panel, and check the padlock appears with no warnings.
If you are registering a Saudi domain, read .sa domains: how to choose, register and connect one. The same rule applies to any domain: the certificate follows the domain, and the domain follows DNS.
Common problems and how to fix them
| What you see | Usual cause | Fix |
|---|---|---|
| Your connection is not private, a year after launch | The certificate expired and did not renew | Enable automatic renewal and an alert before expiry |
| A broken padlock or mixed content warning | An image or file loads over http inside an https page | Switch all internal links to https |
| The domain works but www does not | The certificate does not cover both | Add the other version to the certificate or the redirect |
| The certificate will not issue | DNS records are wrong or have not propagated | Check records with your registrar and wait for propagation |
| An endless loop between http and https | Conflicting encryption settings between the CDN and the server | Align the encryption mode on both sides |
What HTTPS does not do
- Data in transit between visitor and site
- Against eavesdropping on public Wi-Fi
- Against pages being altered on the way
- Proof that the site controls the domain shown
- Against permission flaws inside your app
- Data stored in your database
- Against scam sites; they have padlocks too
- Against weak passwords or exposed keys
Teach your team and customers this point: the padlock means the connection is encrypted, not that the site is trustworthy. Phishing sites imitating banks and stores use HTTPS too. Full security needs a broader list covering permissions, keys and backups; start with the security checklist for AI-built apps.
HTTPS on Fanann: automatic from the first deploy
Apps built on Fanann deploy to hosting with SSL included automatically, on the temporary domain and on your custom domain once connected, with automatic renewal. What stays with you: adding DNS records correctly at your registrar, protecting the registrar account with two-factor login, and making sure any external images or files you add load over HTTPS.
If you own more than one domain for the same business, such as a .sa and a .com, connect both and redirect one to the other so visitors and search results are not split, and make sure the certificate covers both.
Scan the whole app for any link, image, font or file loaded over http instead of https, and fix them all. Make sure the domain with and without www works over HTTPS, that the www version redirects to the main domain, and that any http request permanently redirects to https. Add a small card in the admin panel showing the current certificate's expiry date. Show me what you found before changing anything.
Try it in FanannKey takeaways
- HTTPS encrypts data between visitors and your site and proves the site really is yours.
- Without HTTPS, online payments and Apple Pay will not work and visitors see a Not secure warning.
- A free domain-validated (DV) certificate is enough for most stores and apps.
- Automatic renewal is essential; an expired certificate effectively takes your site offline.
- The padlock does not mean a site is safe from everything; it only protects the connection.
Frequently asked questions
What is an SSL certificate?
My website says Not secure. How do I fix it?
Is an SSL certificate free?
What is the difference between HTTP and HTTPS?
Does the padlock mean a website is trustworthy?
How long does it take to activate an SSL certificate?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “SSL and HTTPS explained for business owners” https://fanann.com/en/blog/ssl-https-explained/ My question: what is an ssl certificate Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.