If your website says "Not Secure" in the browser bar, customers notice. Most will leave without telling you. Some will assume your business is no longer trading.
That warning comes from a missing or broken SSL certificate. This guide explains what SSL does, what changed in 2026 that is catching UK businesses off guard, and what you should check today.
What SSL actually does
SSL stands for Secure Sockets Layer. The modern version is technically called TLS, but most people still call it SSL.
When SSL is installed and working, your website address changes from http:// to https://. That S stands for secure. Visitors see a padlock in their browser bar instead of a warning.
What SSL does underneath is encrypt the connection between your website and the person visiting it. Any information passing between them — a contact form submission, a login, a payment — cannot be read by anyone else in the middle.
For small businesses, SSL matters for three reasons that are easy to overlook:
1. Trust. Visitors make a judgement in seconds. A "Not Secure" warning tells them your site is not safe to use. Most will leave before reading a word of your content.
2. Google. Google has used HTTPS as a ranking signal since 2014. A site without SSL is at a disadvantage in search results, regardless of how good the content is.
3. GDPR. If your website collects any personal information — even just a name and email address through a contact form — you are legally required to protect it. SSL is the baseline technical measure that UK data protection law expects to be in place.
What changed in 2026 — and why it caught some businesses out
In 2026, the way SSL certificates work changed in a way that affected email clients as well as websites.
Certificate authorities (the organisations that issue SSL certificates) now work to a shorter maximum lifespan for publicly trusted TLS certificates. From 15 March 2026, newly issued certificates can be valid for no more than 200 days. The planned reduction continues in stages: no more than 100 days from 15 March 2027, and no more than 47 days from 15 March 2029.
For websites where SSL renewal is automated (which it should be on any decent hosting plan), this change is invisible. The certificate renews in the background with no disruption.
Email clients matter too. Many email applications — Outlook, Apple Mail, Thunderbird — verify SSL certificates when connecting to mail servers. If a certificate expires, does not match the server name, or is not trusted correctly, an email app can show a warning, refuse to connect, or start showing authentication errors.
If you recently saw email certificate warnings appear without changing your password, ask your provider to check the mail server certificate and the server name configured in your email app.
Free SSL vs paid SSL — what do small businesses actually need?
Most small business websites need a Domain Validated (DV) certificate. This is the most common type. It confirms that the website address belongs to you, and encrypts the connection. It is what provides the padlock.
Free SSL certificates — like those issued through Let's Encrypt — provide identical encryption to paid certificates. The difference is not security. It is what the certificate verifies.
A paid Organisation Validated (OV) certificate verifies your business identity as well as the domain. When visitors click the padlock, they see your company name confirmed. For most small business websites, this level of verification is not necessary.
Where paid SSL matters:
- E-commerce sites handling card payments directly (not through Stripe or PayPal)
- Businesses in professional sectors where visible identity verification builds trust
- Organisations that need an extended warranty or commercial SLA on their certificate
For a local trade business, a consultant's website, or a small online shop using a third-party payment processor, free SSL is entirely sufficient and fully GDPR-compliant.
All Eazyhosting plans include free SSL, installed and renewed automatically. You do not need to monitor it or renew it manually.
SSL and your business email — the connection most people miss
SSL certificates are not only relevant to your website. They protect your email traffic too.
When your email client connects to a mail server to send or receive messages, it uses an encrypted connection. That connection relies on a valid SSL certificate on the mail server.
If the certificate expires, or if the email client does not trust it, you may see:
- A warning that the connection is not secure
- A prompt asking you to accept an untrusted certificate
- Emails that fail to send or receive without a clear error
- Authentication failures in Outlook or Apple Mail
For a broader look at how email hosting and SSL work together, see Business Email Hosting UK: What to Look For in 2026.
These symptoms often appear without warning and can look like a password problem or a server outage when the actual cause is a certificate issue.
If your business email stopped working unexpectedly and came back without anyone doing anything, an SSL renewal is worth checking as the cause.
What to check on your site today
You do not need technical knowledge to run a quick SSL check. Here is what to look at:
In your browser. Type your website address with https:// at the start. If you see a padlock, your SSL is active. If you see a "Not Secure" warning or a certificate error, it needs attention.
Check the expiry date. Click the padlock in your browser bar and look for certificate details. You should see an expiry date. If it is within a few weeks, check whether your hosting provider renews it automatically.
Check your contact form. Submit a test enquiry through your own contact form and confirm it arrives. If your SSL has issues, form submissions can fail silently.
Check on mobile. Some certificate errors appear on mobile before desktop because mobile browsers handle certificate validation differently.
If anything looks wrong, or if you are not sure, contact your hosting provider before assuming the site is fine.
How Eazyhosting handles SSL
All Eazyhosting hosting plans include free SSL certificates, installed automatically when your site goes live. Renewal is handled by us — you do not need to track expiry dates or take any action.
If you ever see a certificate warning on your website or email, get in touch and we will check the full setup: the website SSL, the mail server certificate, and the connection between them.
We do not just check whether a padlock is showing. We check whether the certificate is trusted, whether it covers the right domain, and whether your email is connecting securely.
Common questions about SSL for small businesses
Do I need SSL if I do not sell anything online? Yes. If your website has a contact form, collects email addresses, or asks visitors to log in, you are collecting personal data. GDPR requires that data to be protected in transit. SSL is the standard way to meet that requirement.
Is a free SSL certificate as secure as a paid one? Yes, for most small businesses. The encryption strength is identical. Paid certificates add identity verification and come with commercial warranties, but free certificates from reputable providers are fully secure and GDPR-compliant.
What if my SSL keeps expiring? Manual SSL renewal is a sign that your hosting plan is not handling it automatically. Most modern hosting plans renew SSL in the background. If yours does not, it is worth moving to a plan that does.
Will an SSL certificate fix my "Not Secure" warning? It will fix a missing SSL warning, yes. If the warning says "mixed content", that means some elements on the page (images, scripts) are still loading over HTTP rather than HTTPS. That needs a separate fix, but it is a common issue when SSL is first added to an existing site.
If your SSL looks fine but your email is throwing errors, or if you are not sure whether your certificate is set up correctly, get in touch with Eazyhosting. We check the website, the mail server, and the DNS records together, so you get one clear answer rather than being passed between departments.