Does my website need HTTPS?
Yes. HTTPS encrypts the connection between a visitor and your site, so nobody on the same network can read or alter what passes between them. Browsers label plain HTTP pages "Not secure" next to the address, which is a poor first impression for any business, and certificates have been free for years.
Why it matters
Without encryption, anyone on the same café or hotel wireless network can read a contact form as it is submitted and can change the page on the way to the visitor, for example swapping your phone number for theirs. Google has used HTTPS as a ranking signal since 2014 and shows the "Not secure" warning in Chrome, which many visitors read as "this business is not safe". Modern browser features such as location, camera and payment requests only work on secure pages.
What you need
A certificate, issued by a certificate authority, that proves the site is yours. Let's Encrypt issues them free and renews them automatically, and most hosts switch it on with one click. The paid certificates hosts sell add nothing a small business site needs.
How to check
Our check requests your address over https and reports whether it loaded securely. In a browser, the padlock next to the address shows the same thing.
How to fix it
Ask your host to enable a free certificate for the domain. Once it works, change the site's address in its settings to https, set up a redirect so that http addresses forward to https, and update any links inside your content that still use http (a search-and-replace plugin does this in one go on WordPress). Finally check for mixed content: images or scripts still loaded over http, which break the padlock.
Not sure how your own site does on this? Run the free check: it takes about twenty seconds and reports on this and thirty other things.