From DV to EV certificates, Let's Encrypt to paid CAs — everything UK website owners need to know about choosing, installing, and maintaining SSL/TLS certificates.
An SSL/TLS certificate is a small digital file that authenticates your website's identity and enables an encrypted connection between your server and your visitors' browsers. When installed correctly, it turns your site's address from http:// to https://, and displays the padlock icon that users have come to associate with safety.
Despite the name "SSL" persisting in common usage, the protocol itself was replaced by TLS (Transport Layer Security) years ago. TLS 1.2 and TLS 1.3 are the current standards — anything older is considered insecure and should be disabled immediately.
Not all certificates are equal. They differ in the level of validation the Certificate Authority (CA) performs before issuing them:
| Certificate Type | Validation Level | Best For | Typical Cost |
|---|---|---|---|
| Domain Validated (DV) | Domain ownership only | Blogs, personal sites | Free–£10/yr |
| Organisation Validated (OV) | Business identity checked | SMEs, B2B sites | £50–£200/yr |
| Extended Validation (EV) | Rigorous legal checks | Banks, large e-commerce | £100–£500/yr |
| Wildcard | Covers all subdomains | Multi-subdomain sites | £80–£300/yr |
| Multi-Domain (SAN) | Multiple domains | Agencies, SaaS | £100–£400/yr |
For most UK small businesses, a DV certificate from Let's Encrypt (free) or your hosting provider is perfectly adequate. The days when EV certificates showed a green address bar in browsers are over — Chrome and Firefox removed that visual distinction in 2019, so the SEO and trust benefit of EV is now minimal for most use cases.
Let's Encrypt is a free, automated Certificate Authority backed by the Internet Security Research Group (ISRG) and sponsored by major tech companies including Mozilla, Google, and Cisco. It issues DV certificates that are trusted by all major browsers.
The main practical difference from paid certificates is:
This occurs when an HTTPS page loads resources (images, scripts, stylesheets) over HTTP. Browsers block or warn about mixed content, which breaks page functionality and triggers security warnings. The fix is to update all resource URLs to HTTPS.
A certificate that has lapsed causes browsers to display a full-page red warning, immediately destroying visitor trust. Set up auto-renewal and monitoring alerts. WebGuard checks certificate expiry and warns you 30 days in advance.
Older cipher suites like RC4, DES, and 3DES are cryptographically broken. Your server should only offer TLS 1.2+ with strong AEAD cipher suites (AES-GCM, ChaCha20-Poly1305). Tools like SSL Labs and WebGuard will flag weak ciphers.
HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for your domain, even if a user types http:// in the address bar. Without it, a network attacker can intercept the initial HTTP request before the redirect. Add this header to your server:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Self-signed certificates are fine for internal development but should never be used on public-facing websites. Browsers will display an untrusted certificate warning that most visitors will not know how to bypass.
Run a free WebGuard scan on your domain. The report checks:
A healthy certificate setup will score full marks in the SSL/TLS section of your WebGuard report. Any issues come with AI-generated fix instructions tailored to your server stack.
Free scan, no account required. See exactly which issues affect your site.
Start Free ScanSecurity headers are the fastest way to improve your website's security posture. Here's what each one does, why it matters, and the exact code to add it.
CSP and HSTS together block the majority of injection attacks and protocol downgrade attacks. Here's how to implement both correctly without breaking your site.
Email spoofing costs UK businesses millions each year. SPF, DMARC, and DKIM are the three DNS records that stop attackers from impersonating your domain. Here's how to set them up.