Short answer: yes. Not because of a rule, but because browsers now actively warn people away from sites without one. If your website loads over http:// rather than https://, Chrome puts “Not secure” in the address bar, right where a visitor is deciding whether to trust you.
The longer answer is worth reading if you are being sold an expensive certificate and are not sure why.
What an SSL certificate actually does
It encrypts the connection between a visitor’s browser and your website, so anything travelling between them cannot be read in transit. That is it. Two things follow:
- Data is protected in transit. Contact form details, login credentials, card numbers. On an unencrypted connection — a café’s shared wi-fi, say — that information is readable by anyone positioned to look.
- The site is verified as genuine. The certificate confirms that the visitor is talking to the real yourbusiness.co.nz, and not something impersonating it.
What it does not do is protect the site itself. An SSL certificate will not stop a site being hacked, will not remove malware, and will not fix an out-of-date plugin. Encrypting the road does not lock the building. That is a separate job, covered by website security and backups.
Three reasons it is no longer optional
1. Browsers say so, loudly
Chrome, Edge, Firefox and Safari all flag sites served over plain HTTP. Anyone who is even slightly cautious about who they give a phone number to will hesitate at a “Not secure” label — and most people will never articulate why they left.
2. Google uses it as a ranking signal
HTTPS has been a lightweight ranking factor for years. It is not a large one, and adding a certificate will not vault you up the results. But when two comparable pages compete, the secure one has the edge, and there is no reason to hand that away.
3. Forms and payments effectively require it
If you take card details, HTTPS is non-negotiable — the payment card standards require it. Even without payments, any form collecting names, phone numbers or addresses should be encrypted. Under the Privacy Act 2020, New Zealand businesses have an obligation to take reasonable steps to protect personal information they hold. Sending it across the internet in plain text is difficult to describe as reasonable when a certificate costs so little.
DV, OV, EV — what the letters mean
| Type | What is checked | Suits |
|---|---|---|
| DV — Domain Validated | That you control the domain. Issued in minutes. | Most business websites, brochure sites, blogs |
| OV — Organisation Validated | Domain control plus your organisation’s existence. Days. | Businesses handling customer accounts or sensitive data |
| EV — Extended Validation | Rigorous checks on the legal entity. Longer, and costlier. | Finance, health, large eCommerce |
Here is the part providers rarely volunteer: the encryption is identical in all three. A DV certificate encrypts exactly as strongly as an EV one. What you are paying more for is the depth of the identity check behind it.
EV used to display the company name in a green bar in the address bar, which was a visible trust cue worth paying for. Browsers removed that treatment years ago. For most New Zealand small businesses, a DV certificate is the right answer, and anyone insisting you need EV for a plumbing website is selling rather than advising.
Covering more than one address
- Single-domain covers yourbusiness.co.nz and its www. Fine for one site.
- Wildcard covers unlimited subdomains — shop., blog., portal. Worth it once you have three or more.
- Multi-domain (SAN) covers several separate domains on one certificate. Useful if you hold .co.nz and .nz and serve both.
Free certificates versus paid ones
Free certificates from Let’s Encrypt are real, properly trusted DV certificates, and most good hosting includes them and renews them automatically. They are genuinely fine for a brochure site.
You would choose a paid certificate for one of three reasons: you need OV or EV validation; you want a warranty attached; or — most commonly, and most honestly — you want somebody else to be responsible for installing and renewing it. A free certificate that silently fails to renew takes your site offline behind a browser warning until someone notices. That is what managed SSL is actually for: not better encryption, but somebody else owning the renewal.
Getting it working properly
Installing the certificate is half the job. Do these too:
- Redirect HTTP to HTTPS. Otherwise both versions stay live and you have duplicated your whole site in Google’s eyes.
- Fix mixed content. If a page loads over HTTPS but pulls an image or script over HTTP, browsers still flag it. Usually a handful of hard-coded links in your theme or old posts.
- Update your site address in your CMS settings to the https version.
- Tell Search Console. Treat the https site as the property and resubmit your sitemap.
- Set renewal to automatic. Certificates expire — 90 days for Let’s Encrypt, typically a year for paid ones. An expired certificate is worse than none: visitors get a full-page warning, not a small label.
The usual objections
“I don’t take payments.” — You almost certainly take contact details, which are personal information, and the browser warning appears regardless.
“It’ll slow my site down.” — It hasn’t for years. Modern HTTPS supports protocols that make encrypted sites faster than unencrypted ones.
“It’s too technical.” — On decent hosting it is one switch. Our hosting plans include SSL, issued and renewed without you doing anything.
If your site currently shows “Not secure”, that is worth fixing this week rather than this quarter. Compare SSL options, or ask us to check your site and tell you plainly which certificate you need — and, just as usefully, which you don’t.