This site's SEO course already covers HTTPS as a baseline requirement. This lesson covers the hosting side directly: what a certificate actually is, and how to get one onto your own server.
Plain HTTP sends everything — including anything typed into a form — as readable plain text, visible to anything positioned between the browser and the server. HTTPS encrypts that connection, so the content is unreadable to anyone intercepting it in between, even though it still travels over the same network path.
An SSL/TLS certificate (the terms are used interchangeably in casual conversation; TLS is the modern, correct name for what most people still call SSL) is a small file, issued by a trusted certificate authority, that proves a server genuinely controls the domain it claims to represent, and enables the encryption itself.
Let's Encrypt issues certificates at no cost, and most hosting control panels integrate it directly — often a single toggle, with automatic renewal handled entirely behind the scenes. There is no longer a real cost argument for a site running on plain HTTP. Most cloud and managed platforms covered earlier in this category provision HTTPS automatically for any domain you connect, with no separate step at all.
Browsers now mark plain-HTTP pages as "Not Secure" directly in the address bar, and some browser features (camera and location access, service workers, among others) are simply unavailable without HTTPS. Combined with the SEO course's point that HTTPS is a baseline ranking signal, this is a case where there is genuinely no remaining reason to skip it — every hosting type covered in this category supports it, usually for free.
Redirect HTTP to HTTPS, always
Enabling HTTPS without also redirecting the old plain-HTTP version to it leaves both versions of your site live at once — a duplicate that confuses search engines and splits any accumulated ranking signals between two addresses. A permanent (301) redirect from http:// to https:// is a required companion step, not an optional extra, every time HTTPS is turned on for an existing site.
Certificates expire, typically after a period of months, specifically so a compromised or outdated one cannot remain trusted indefinitely. Modern free certificate services renew automatically with no action from you; if using an older manual process, an expired certificate is a real, visible failure — visitors see a security warning rather than a working site, so tracking renewal dates matters if this isn't automated for you.