Upgrowly
← Blog

Website Security Basics: HTTPS, SSL and Staying Safe

By Neha

"Who would bother hacking my little website? I sell curtains."

Nobody, personally. That is the misunderstanding. Websites are not usually broken into by someone who chose them. They are found by automated programs that sweep the whole internet looking for an out-of-date plugin or a weak password, the way a thief tries every car door in a parking lot. A curtain shop with an old WordPress plugin is exactly as findable as a bank with one.

And what attackers do with a small site is rarely dramatic. They quietly add hidden pages selling pills or betting, or redirect your visitors on mobile to a scam, or use your server to send spam. You may not notice for weeks. Google does notice, and puts a red warning in front of your site.

Website security basics are not complicated and mostly not expensive. This guide covers the handful of things that prevent nearly all of it, in the order worth doing them.

HTTPS and the padlock: what they mean

Look at the address bar. A site address starts with either http:// or https://. The extra S stands for secure. With HTTPS, everything passing between the visitor's phone and your website is scrambled, so that nobody in between, such as someone on the same café Wi-Fi, can read or change it.

The thing that makes HTTPS possible is an SSL certificate, a small file installed on your server that proves the site is really yours and holds the key for the scrambling. Strictly, the modern technology is called TLS, but everyone still says SSL.

Why it matters even if you take no payments:

  • Browsers warn people away. Chrome labels a site without HTTPS "Not secure" in the address bar, and shows a full-page warning in some cases. Many visitors leave at once.
  • Forms need it. A contact form on plain HTTP sends names and phone numbers in readable text.
  • Google prefers it. HTTPS is a small ranking factor, and has been for years.
  • Other features depend on it. Many modern browser features, and most payment gateways, will not work without it.

One thing the padlock does not mean: that the business is trustworthy. It only means the connection is private. Scam sites have padlocks too.

Getting an SSL certificate, usually for free

You should almost never have to pay for a basic certificate. A non-profit called Let's Encrypt issues them free, and nearly every reputable host has it built in.

  • Shopify, Wix, Squarespace, Blogger. HTTPS is automatic. Nothing to do.
  • Shared hosting with cPanel or similar. Look for "SSL/TLS Status" or "Let's Encrypt" in the control panel and switch it on. If your host charges ₹2,000 a year for a basic certificate and offers no free one, that is a reason to consider another host.
  • Cloudflare. Its free plan puts HTTPS in front of any site.

Paid certificates exist with extra company verification, and they suit banks and large stores. A small business site gains nothing visible from them.

After switching it on, three follow-up jobs:

  1. Redirect HTTP to HTTPS. The old http:// address should send everyone to the secure one automatically.
  2. Fix mixed content. If the page loads over HTTPS but some images or scripts still use http:// addresses, the browser may block them or drop the padlock. Update those links.
  3. Update your listings. Change the address to https in your Google Business Profile, Search Console and social bios.

Certificates expire, typically every three months for free ones. Renewal is normally automatic, but automatic things fail. When one lapses, every visitor sees a frightening full-screen warning. The domain and SSL expiry checker shows when up to 10 domains and their certificates run out.

Updates: the dull habit that stops most break-ins

If your site runs on WordPress, this section matters more than everything else in the article. The large majority of hacked WordPress sites were broken into through an outdated plugin or theme with a known hole. The fix had usually been released already. Nobody had clicked "update".

  • Turn on automatic updates for WordPress itself and for plugins where you can.
  • Log in once a month and apply whatever is waiting.
  • Delete plugins and themes you do not use. Deactivated is not enough. If the files are on the server, the hole is still there.
  • Never install "nulled" premium themes or plugins. These are pirated copies offered free, and they very often come with a back door already built in.
  • Prefer plugins that are actively maintained. Check when one was last updated before installing it. Two years of silence is a warning.

Not sure what your site runs on, or what a competitor uses? The website technology checker shows the platform and what that means.

Passwords and logins

The second most common way in is simply guessing the password.

  • Never "admin" as the username. It is the first one every automated attack tries.
  • A long, unique password for the website, the hosting account and the domain account. Three different ones. A password manager makes this painless.
  • Two-step login on all three, and on the email account they are registered to. If someone controls that email, they can reset everything else.
  • One account per person. When a developer or employee finishes, remove their account the same day. Shared logins that outlive the relationship are a classic source of trouble.
  • Limit login attempts. A small plugin that blocks an address after several wrong guesses stops the endless automated trying.

And keep ownership in your own hands. The hosting and domain should be in accounts you control. Our guide on how to choose a domain name explains why that matters so much.

Backups: what turns a disaster into an inconvenience

Everything above lowers the odds. A backup is what saves you when the odds lose. With a clean copy from last week, a hacked site is a two-hour repair. Without one, it can mean rebuilding from nothing.

A backup is only real if it meets three tests:

  1. Automatic. Daily or weekly, without anyone remembering.
  2. Stored somewhere else. Not only on the same server. If the server is compromised, so is the backup sitting on it. Google Drive, Dropbox or the host's separate backup service all work.
  3. Tested. At least once, actually restore it, or have your developer do so. Many people discover that their backups were empty on the day they need them.

Ask your host or developer today: is there an automatic backup, where is it kept, and when was it last tested?

Security headers, in plain words

Beyond the basics there is a layer of settings called security headers. These are short instructions your server sends with every page, telling the browser how to behave. One says "always use the secure connection". Another says "do not let other websites display this page inside a frame", which blocks a trick used to fool people into clicking things.

They are a few lines of configuration and cost nothing. The security headers checker grades your site from A to F and gives the exact line to add for each fix, which you can pass straight to your developer or host. To see the raw response your server sends, including redirects and caching, use the HTTP header checker.

For a brochure website, do the certificate, updates, passwords and backups first. Headers are the polish after that.

Signs your site may already be hacked

  • Google shows "This site may be hacked" or a red "Deceptive site ahead" screen.
  • Searching your business name brings up pages in another language or about products you do not sell.
  • Visitors on phones are redirected somewhere else, while everything looks normal to you on a laptop.
  • Admin users you do not recognise.
  • A sudden collapse in visitors, or a security warning in Search Console.

If it happens: change every password, restore the last clean backup, update everything, then use the Security Issues report in Search Console to ask Google for a review. If you have no backup, a professional clean-up is worth paying for. A full SEO audit afterwards will catch leftover damage such as spam pages and broken links.

Frequently asked questions

What is the difference between SSL and HTTPS?

An SSL certificate is the file installed on your server. HTTPS is the secure connection that the certificate makes possible. You install the first to get the second.

Is a free SSL certificate safe enough?

Yes. A free certificate from Let's Encrypt gives the same strength of encryption as a paid basic one. Paid certificates add identity checks on the company, which small business sites rarely need.

Does HTTPS improve my Google ranking?

Slightly. It is a minor ranking signal. The larger effect is indirect: visitors are not scared off by a "Not secure" warning, so more of them stay and get in touch.