Do I need an SSL certificate for a small business website?

Yes, and it is no longer optional in practice. Chrome, Safari and Firefox already label plain HTTP pages as not secure, and Chrome warns visitors as they type into a form on such a page. Google is going further: Google has announced it will turn on Always Use Secure Connections by default, reaching around a billion Enhanced Safe Browsing users in Chrome 147 in April 2026 and all users in Chrome 154 in October 2026. Google states that Chrome will ask for the user's permission before the first access to any public site without HTTPS, with a warning that the site does not support a secure connection and that attackers could view or change information. For a local trade whose site exists to make a stranger comfortable enough to send a quote request, a browser permission prompt before the page even loads is the opposite of that.

How much should an SSL certificate cost?

For an ordinary local-business website, nothing. Let's Encrypt is a nonprofit certificate authority that states plainly that it does not charge a fee for its certificates, and it is built for automation: standard certificates are valid for 90 days and clients are expected to renew them automatically, with a shorter six-day option available. Most modern hosting issues and renews these for you with no involvement on your part. So if your website bill has SSL as a separate line item, that is a packaging decision, not a cost being passed through. Paid certificates do exist for organization-validated and extended-validation use, but a painter, plumber or cleaner does not need one, and no browser rewards you for buying one.

Does a Not Secure warning hurt my Google ranking?

Google has said for years that HTTPS is a lightweight ranking signal, so the direct search effect is small and is not what should worry you. The damage is on the human side. The visitor who sees a warning does not investigate it, they go back to the results and tap the next contractor, so the loss shows up as a quiet month rather than a broken website. A second risk is repair calls: expired certificates are a favorite hook for cold callers who tell you Google is about to delist you unless you buy their package. Treat any inbound call about your website security the same way you treat one about your Google listing, which is to hang up and check it yourself.

RunCabin Blog · Fix-it guide

Why does my website say "Not Secure"?

Q: Why does my website say Not Secure?

In almost every case it does not mean your site was hacked or has a virus. It means the connection between your site and the visitor is not encrypted, or the certificate that does the encrypting has a problem. There are five common causes for a small local-business site: the site is still served over plain HTTP with no certificate at all; the certificate existed but expired and nothing renewed it; the certificate covers one version of your address but not the other, so example.com works and www.example.com throws a warning; the page loads over HTTPS but pulls in images or scripts over insecure HTTP, which browsers call mixed content; or the domain now points at a host that has no certificate for it, which is common after a move between website companies. All five are fixed at the hosting level, not by rewriting your site.

August 13, 2026 · 7 min read

You almost certainly were not hacked. That is the first thing to get off your chest, because the wording is alarming and the actual meaning is dull. "Not secure" means the connection between your website and the person looking at it is not encrypted, or the certificate that does the encrypting has lapsed or does not match the address they typed. Nobody broke in. A renewal did not happen, or it was never set up.

The second thing: this is a hosting problem, not a website problem. You do not need to rewrite a page, redo your photos or hire anybody to "clean" the site. Somebody needs to fix one setting on the machine your site lives on, and for a normal local-business site the part everyone worries about paying for is free.

What the customer actually sees

There are three flavors, and they are wildly different in how much they cost you.

"Not secure" in the address bar. Quiet, easy to miss on a phone, and the version most owners have. Chrome, Safari and Firefox all mark plain HTTP pages this way.
A warning as somebody types. On an unencrypted page, Chrome escalates when a visitor starts filling in a form. That is the worst possible moment, because it lands on exactly the person who was about to send you a quote request.
A full-page red interstitial. "Your connection is not private," with a code like NET::ERR_CERT_DATE_INVALID and a button to go back. This is the expired-certificate version, and it is a wall. Your site is effectively offline to anyone unwilling to click through a security warning to reach a painter.

Owners tend to discover the third one from a customer, weeks in. Nobody calls to tell you about the first two. They just leave.

The part that makes this urgent in 2026

This has been drifting from cosmetic to serious for a decade, and there is now a date on the calendar. Google has announced it is turning on the Chrome setting called Always Use Secure Connections by default: for the roughly one billion people on Enhanced Safe Browsing in Chrome 147 in April 2026, and for everybody in Chrome 154 in October 2026.

What that means in practice, in Google's own words, is that "Chrome will ask for the user's permission before the first access to any public site without HTTPS," in a dialog telling them the site "does not support a secure connection" and that "attackers could view or change information." Local addresses and intranet sites are excluded, and users can still switch the warnings off. But for a public business site, the default behavior shifts from a small label to a question the visitor has to answer before your homepage loads.

Put that next to what a local trade's website is for. A homeowner heard your name, looked you up, and is deciding whether to let you into their house. We have written before about how fast that check happens. A browser asking them to grant permission to view your site is not a detail they will interpret charitably.

The five causes, and how to tell which one you have

Open your site on a phone and a laptop, try both the plain and the www version of your address, and match what you see to this list.

No certificate at all. The address stays on http:// and every page is labeled not secure. Common on older sites built before this mattered and never touched since. Fix: the host enables HTTPS and redirects HTTP traffic to it.
The certificate expired. The site worked in the spring and throws a full-page warning now. Certificates are short-lived on purpose, so something has to renew them automatically. When a site is abandoned, this is usually the first visible symptom. If that sounds like your situation, start with getting control of your domain and hosting rather than chasing the warning.
The certificate does not cover the address people typed. yourbusiness.com loads fine, www.yourbusiness.com throws a warning, or the other way around. Both should be covered and one should redirect to the other. This one hides for months because you always type it the way that works.
Mixed content. The page itself loads over HTTPS but pulls in an image, font or script over insecure HTTP. Browsers block or upgrade a lot of this now, so the usual result is a broken photo or a padlock that never goes fully clean. Typically leftover hard-coded links after a site moved.
The domain points somewhere stale. You switched website companies, or a subscription ended, and the domain still resolves to a host with no certificate for it. See also: what actually happens to a site and domain when you cancel.

All five live with whoever runs your hosting. None require you to learn anything about certificates.

What this should cost: nothing

Here is the part worth knowing before anybody quotes you. Let's Encrypt is a nonprofit certificate authority that states outright that it does not charge a fee for its certificates. It is designed around automation: standard certificates are valid for 90 days, subscribers can opt into six-day certificates, and the whole model assumes software renews them on a schedule without a human involved. Modern hosting issues and renews these silently. Nobody should be reminding you about it annually.

So if there is a line item on your website bill for SSL, that is packaging, not a cost being passed on to you. Paid certificates are real and have real uses in banking and enterprise, where the certificate authority verifies the legal organization behind the site. A three-truck landscaping company does not need one, and no browser gives you a better padlock for buying one. If a proposal shows an annual SSL charge, that is a fair question to ask about, in the same spirit as the rest of the fine print in website pricing.

If somebody called to tell you about this

Worth naming, because the timing is rarely a coincidence. An expired certificate is a gift to cold callers: it is real, it is visible to anyone, and it sounds catastrophic when described over the phone. The script is that Google is about to delist you, that your customers' information is exposed, and that their team can secure it today for a monthly fee.

Owners in the trades know this pattern well. As one poster on an HVAC forum put it, "about 10 minutes after your business site goes live people will start calling and emailing about SEO services." The security version is the same call with different vocabulary. Two rules hold up: never buy a fix for a problem you have not personally seen in your own browser, and never authorize anything about your website, domain or Google listing on an inbound call. Go look at your site, then call whoever actually runs your hosting. There is more on the genre in why these calls flood a new business.

Does it hurt your Google ranking?

A little, and it is the least interesting part. Google has said for years that HTTPS is a lightweight ranking signal, so it is a nudge rather than a penalty. Chasing the ranking angle misreads where the money leaks.

The real loss is human and invisible. The person who sees a warning does not report it, ask a follow-up question or come back later. They tap the back button and call the next contractor in the results, and you never learn that it happened. It shows up in your books as a slow month with no obvious cause, which is exactly how a website quietly stops producing work.

Worth one extra thought if you take deposits or run a quote form: the form is where a customer types their name, address, phone and a description of what is wrong with their house. That should never travel unencrypted, and the browser is right to say so.

A five-minute check

Open your site on your phone. Does the address bar say "Not secure" anywhere?
Type both versions by hand: yourbusiness.com and www.yourbusiness.com. Do both load cleanly?
Click into an interior page, a service page and your contact page. The warning can be page-specific.
Start typing in your own quote form. Does anything change in the address bar?
Check the link on your Google Business Profile, your Facebook page and your email signature. If any of them still say http://, update them to https://.
Ask your host or whoever runs the site one question: is HTTPS on, and does the certificate renew automatically? Those are the only two answers you need.

Do this on the first of the month, quarterly, or any time you change hosts. A silent renewal failure looks exactly like a normal site until it does not.

Where RunCabin fits

RunCabin builds and runs the site for $39.99/mo, flat, and this whole category of problem is on our side of the line. HTTPS is on from the first minute your site goes live, the certificate renews itself, both the plain and www versions of your domain resolve to the same secure site, and your quote form is encrypted end to end. There is no SSL line item, because there is no SSL bill. Your domain, professional email and a logo are included, with no setup fee and no contract.

That is the honest pitch here: not that certificates are hard, but that nobody starting a painting or plumbing business should be the person responsible for remembering them. When something on the site needs to change you ask for it in plain English and it changes in moments. The site is yours, and so is the domain, whenever you want to take them elsewhere.

See your site before you pay a cent

No sales call, no card. We build a real preview with your name, your trade and your service area, secure and live from the first minute.

See your free site preview →