Do I need SSL for my website?
Last updated: 26 August 2026 · Reviewed: 26 August 2026 · By: Alston Antony
Yes, every public website needs SSL/TLS (the https:// padlock), and it should be free.
Chrome, Safari, Edge and Firefox all show a "Not secure" warning on any http:// page with a form field,
and Google has ranked HTTPS above HTTP as a tie-breaker since 2014. Let's Encrypt issues a valid certificate in
under a minute through cPanel AutoSSL or Plesk, renews it every 60 days automatically, and never bills you. Paid
certificates are a niche compliance product, not a security upgrade.
Why an unsecured site is a broken site in 2026
Browsers stopped treating http:// as "fine unless you handle payments" in 2018, when Chrome began
flagging every non-HTTPS page as "Not secure" in the address bar. Any form on an http page, contact form included,
shows a red warning the moment a visitor clicks into a field. Facebook, LinkedIn and WhatsApp preview links from
http pages with the same warning. Google Search Console reports the site as containing "insecure resources" the
first time it crawls. The net effect for a Sri Lankan business site: quote form submissions drop and the site
looks like it was abandoned five years ago.
How Let's Encrypt gives you SSL free, in under a minute
Let's Encrypt is a non-profit certificate authority founded by the Internet Security Research Group. Certificates
are issued for 90 days and renewed automatically 30 days before expiry via the ACME protocol. In cPanel the feature
is called AutoSSL and it runs a nightly job that checks every domain and subdomain and renews anything within the
window. In Plesk, DirectAdmin and CloudLinux the plumbing is the same. On a fresh Sri Lankan domain the flow is:
point the domain's A record at the host, wait 15 to 30 minutes for DNS to reach the host's resolver, and the
certificate issues on the next AutoSSL run, usually within an hour. Force HTTPS with a single line in the
.htaccess file once the padlock appears.
When paid SSL is actually needed (mostly, it is not)
Paid certificates come in three tiers, DV (domain-validated), OV (organisation-validated) and EV (extended validation). All three deliver the same encryption as Let's Encrypt. The only meaningful difference is the identity check the issuer performs before issuing. Chrome removed the green-bar EV indicator in 2019, so an EV certificate on a WooCommerce checkout looks identical to a Let's Encrypt one. Real cases where a paid certificate is required in Sri Lanka: a payment processor or bank names a specific issuer in a contract, or a site needs a wildcard covering many subdomains that AutoSSL cannot enumerate. Everything else is upsell.
When you can skip SSL (short list)
For a public website reachable from any browser, never. The only realistic case is an internal service on a private network with no DNS entry pointing to it, and even then a self-signed certificate is cheap peace of mind. If a Sri Lankan agency or reseller is quoting LKR 8,000 to LKR 15,000 per year for a "premium SSL" on a small business site (quotes checked 2026-08-27), the honest read is: they are billing for a free certificate. Ask them to install Let's Encrypt instead and put the saved money into a real backup product.
Frequently asked questions
Is Let's Encrypt SSL good enough for a business website?
Yes. Let's Encrypt is a standard domain-validated TLS certificate accepted by every major browser and payment gateway. It renews every 60 days automatically via ACME. The cheapest paid DV certificate provides the same encryption; the only real difference is the vendor logo on the seal.
How long does it take to get SSL working on a new site?
In cPanel AutoSSL or Plesk, issuance takes under 60 seconds once the domain resolves to the host. On a fresh .lk domain, budget an extra 15 to 30 minutes for DNS to reach the host, then the certificate is live automatically. Force HTTPS with a redirect once the padlock shows.
When would a paid SSL certificate actually help?
Only for narrow compliance cases like an OV or EV certificate a bank or payment processor names in writing, or a wildcard certificate covering many subdomains where AutoSSL will not scale. For a Sri Lankan business website, WooCommerce store, or WordPress blog, the paid tier adds no functional trust or ranking benefit.
Does SSL slow down my Sri Lankan site?
No, once TLS 1.3 and HTTP/2 are enabled the handshake adds roughly one round trip on the first connection, then reuses the session. For a Colombo visitor to a Singapore or Mumbai host that is under 100 ms of extra time on the first request, and zero on subsequent requests. Every mainstream host runs TLS 1.3 by default.
Sources & references
- Let's Encrypt statistics — Active certificates and issuance volume (checked 26 Aug 2026)
- cPanel AutoSSL documentation — Free Let's Encrypt provider inside cPanel (checked 26 Aug 2026)
- Google Search Central - HTTPS as a ranking signal — Confirmed since 2014 (checked 26 Aug 2026)
- Chrome - Not Secure warning rollout — Applied to all http pages from 2018 (checked 26 Aug 2026)