Security & Compliance
SSL/TLS Certificate
The certificate that enables HTTPS, encrypting traffic between browser and server and proving the site is who it claims to be.
An SSL/TLS certificate is what puts the padlock in the browser and the S in HTTPS. It encrypts the connection between a visitor and your server, so nobody in between can read or tamper with the traffic, and it verifies that your server is genuinely who it claims to be. TLS is the modern protocol, and "SSL" is the old name that stuck. Today it's mandatory, since browsers actively warn users away from unencrypted sites.
The good news is that certificates went from a paid annoyance to free and automatic. Let's Encrypt issues them at no cost, and nearly every host, DigitalOcean, Netlify, Vercel, Cloudflare, the managed WordPress providers, provisions and renews them for you without a thought. The days of buying and manually installing a certificate each year are mostly gone.
Where it still needs attention is renewal and coverage. Certificates expire, usually every 90 days for Let's Encrypt, so automated renewal has to actually work, and a wildcard or multi-domain certificate is needed if you run subdomains. A lapsed certificate turns your site into a scary browser warning overnight.
Go deeper
- Cloud Hosting Security: What's Your Job vs the Provider'sThe shared responsibility model, and the specific things people forget to configure.