SSL certificates: why you need one and what happens without

For several years now browsers have marked sites without HTTPS as "not secure" right in the address bar, and forms on such pages trigger a warning when data is entered. For a commercial site that means losing part of your visitors before they even see the offer. But a certificate is worth more than the absence of a red label.

What happens without encryption

Data travels between browser and server in plain text. Any node along the way — public Wi-Fi in a cafe, a compromised router, an unscrupulous provider — can read the contents and alter them. The classic tampering scenario: a provider injects its own ads into someone else's pages, and malware overlays a phishing payment form on top of yours. Session cookies are a separate problem: an intercepted administrator cookie grants full access to the site control panel without any password at all.

Certificate types and when you need which

• DV (domain validation) — issued automatically within minutes, confirms control of the domain. Covers the needs of 90% of sites.
• OV (organisation validation) — additionally confirms the legal entity exists; issuance takes a few days. Sensible for B2B portals.
• EV (extended validation) — the most thorough check, though almost no visual advantage remains in modern browsers. Still relevant for financial services.
• Wildcard — covers all subdomains at one level, handy when you have many regional or client subdomains.

What it costs

Automatically issued DV certificates are free and renew every 90 days without human involvement. These are what we install by default when launching projects. Paid options run from 3,000 to 40,000 roubles a year, and their real value lies not in the cryptography (which is identical) but in the legal verification of the organisation and the certificate authority's financial guarantees. Certificates from Russian certification authorities are a separate matter, required in a number of government and industry contexts.

Mistakes that make the certificate worthless

• Mixed content: the page loads over HTTPS but pulls in a script or image over HTTP. The browser blocks the resource, the layout breaks and the protection is undermined.
• No redirect from HTTP to HTTPS — half the traffic keeps travelling in the clear, and search engines see two versions of the site.
• Secure attributes not set on cookies — the session can leak over an unprotected channel.
• A forgotten renewal. An expired certificate is worse than none: the browser shows a full-screen warning that scares off almost everyone.
• A certificate issued for only one variant of the domain — with or without www — while the other version returns an error.

Effect on search and conversion

HTTPS has long been part of the technical ranking factors, but the direct effect is small. The indirect effect matters far more: without a secure connection, modern browser capabilities are unavailable — geolocation, service workers, and therefore PWA. Analytics suffers too: visits from secure sites to insecure ones lose the traffic source and land in "direct", distorting the whole picture for SEO work. The technical details of the protocol and security headers are well covered in the MDN documentation.

A five-minute check

Open the site in a private window and check the padlock in the address bar. Enter the address with http:// and confirm that it redirects to https. Open the developer console and look for mixed content warnings. Check the certificate expiry date and whether auto-renewal is on. If anything on this list does not add up, it is an hour of work worth closing before your next ad campaign. Write to us if you need help migrating to HTTPS without losing rankings.