What Is SSL? A Plain-English Guide for NZ Website Owners
If you have ever noticed the little padlock next to a website’s address, or seen a browser warn you that a site is “Not Secure”, you have already met SSL. It is the technology that keeps the connection between a visitor and a website private. This guide explains what SSL is, what it actually does, why every New Zealand website needs it, and how to get it — without the jargon.
What SSL actually does
SSL (Secure Sockets Layer) is a security technology that encrypts the connection between a visitor’s browser and the website’s server. When a site uses SSL, the data travelling between the two — passwords, contact form details, credit card numbers — is scrambled so that anyone intercepting it sees only gibberish.
It does three things at once. It encrypts the data so it cannot be read in transit. It authenticates the website, confirming visitors are connected to the genuine server and not an impostor. And it protects the integrity of the data, so it cannot be tampered with on the way. A site using SSL shows https:// and a padlock in the address bar, instead of plain http://.
SSL, TLS, and the padlock: the terminology
One point of confusion worth clearing up: the protocol that actually secures modern websites is TLS (Transport Layer Security), the successor to the original SSL. The old SSL versions are long retired. In everyday use, though, almost everyone — including certificate providers — still calls them “SSL certificates”, so that is the term you will see, even though TLS is doing the work under the hood. When you read “SSL” here and elsewhere, it means the modern SSL/TLS standard.
The certificate itself is a small file, issued by a trusted Certificate Authority (CA), that vouches for the site’s identity. When a browser connects, it checks that certificate is valid and issued by a CA it trusts, then establishes the encrypted connection.
Why every NZ website needs SSL now
SSL used to be seen as something only online shops needed. That is no longer true — it is now expected on every website, for several reasons.
Types of SSL certificate
All provide the same encryption strength — they differ in how much the owner is vetted.
| Type | Vetting | Best for |
|---|---|---|
| Domain Validated (DV) | Confirms domain control only | Most sites — free via Let’s Encrypt |
| Organisation Validated (OV) | Verifies the organisation | Businesses wanting extra assurance |
| Extended Validation (EV) | Rigorous business vetting | Large orgs, financial institutions |
For most New Zealand websites, a free DV certificate from Let’s Encrypt (included by most hosts) is all you need.
The most visible reason is browser warnings. Modern browsers actively label any site without SSL as “Not Secure” in the address bar, which erodes visitor trust immediately — a real problem for a New Zealand business trying to look credible. There is also a genuine security and privacy dimension: if your site collects any personal information, encrypting it in transit is a basic safeguard, and handling people’s information responsibly aligns with the expectations of the Privacy Act 2020.
Search visibility is often cited too, and here it is worth being accurate: Google does treat HTTPS as a ranking signal, but a very lightweight one — essentially a tiebreaker between otherwise equal results, not a significant boost. So the real reasons to have SSL are security, trust, and avoiding those “Not Secure” warnings; any SEO benefit is minor and secondary.
Free vs paid SSL certificates
You do not have to pay for SSL. This surprises people, so it is worth explaining the options.
For the vast majority of websites — blogs, business sites, most online shops — a free certificate from Let’s Encrypt is all you need. Let’s Encrypt is a non-profit CA that issues free domain-validated (DV) certificates, and most New Zealand hosts include them automatically at no cost. A DV certificate provides exactly the same strength of encryption as a paid one; the difference is only in the level of identity checking, not the security.
Paid certificates (organisation-validated and extended-validation) involve more thorough vetting of the business behind the site, which some large organisations or financial institutions prefer. But for a typical site, paying for SSL buys you little that free SSL does not already provide.
SSL best practices for WordPress
Getting a certificate is only part of the job. A few practices keep it working properly.
Serve every page over HTTPS, not just the login or checkout, so nothing is left unencrypted. Watch for mixed content — warnings that appear when a secured page still loads some elements (images, scripts) over insecure HTTP; an SSL-checker tool will flag these so you can fix them. Choose a reputable certificate, which with free Let’s Encrypt is handled for you. And make sure renewal is automatic — Let’s Encrypt certificates last 90 days and almost all hosts renew them automatically, so you never face an expired certificate and a suddenly “insecure” site.
How to get SSL on your site
The good news is that on most New Zealand hosts, SSL is free and often enabled by default. If yours is not already active, our step-by-step guide to enabling SSL on NZ WordPress hosting walks through the whole process, including fixing mixed-content warnings. For the bigger picture of keeping a site safe, see our WordPress security best practices guide, and the main WordPress hosting hub for choosing a host that includes SSL.
This guide provides general information about SSL/TLS, not specific security advice. Security standards evolve, so treat it as a starting point, keep your certificate current, and confirm details with your host or a qualified professional where needed.
Reference sources
Frequently asked questions
What is an SSL certificate in simple terms?
It is a small file that encrypts the connection between a visitor’s browser and your website, and confirms your site’s identity. When it is active, your address shows https:// and a padlock, and any information visitors send — form details, passwords — is scrambled so it cannot be read in transit.
Is SSL the same as TLS?
Effectively, yes. TLS (Transport Layer Security) is the modern successor to the original SSL, and it is what actually secures websites today. The old term “SSL” has stuck, so certificates are still called “SSL certificates” even though TLS does the work. When people say SSL now, they mean the current SSL/TLS standard.
Do I need to pay for SSL?
Usually not. Let’s Encrypt issues free certificates that most New Zealand hosts include automatically, and they provide the same encryption strength as paid ones. Paid certificates add more thorough identity vetting, which some large organisations prefer, but a typical site is well served by free SSL.
Does SSL help my Google ranking?
Only slightly. Google treats HTTPS as a lightweight ranking signal — more of a tiebreaker than a real boost. The important reasons to have SSL are security, visitor trust, and avoiding the “Not Secure” warning browsers show on unencrypted sites. Treat any SEO benefit as a minor bonus.
What is a mixed content warning?
It appears when a page loads over secure HTTPS but still pulls some elements — such as images or scripts — over insecure HTTP. Browsers flag this because it partly undermines the encryption. An SSL-checker tool will identify the offending elements so you can update them to HTTPS and clear the warning.
How often does an SSL certificate need renewing?
Free Let’s Encrypt certificates last 90 days, while paid ones typically run a year. In practice you rarely manage this by hand — almost all hosts renew certificates automatically, so your site stays secure without an expired certificate ever causing a “not secure” error. It is worth confirming auto-renewal is on.