In short and in plain language
Some websites show a warning in the browser. The browser is the program you use to open websites. The warning shows up when the connection is not encrypted.
Many visitors then leave right away. So you lose enquiries before anyone sees your offer.
SSL encrypts the connection. It protects what people type into forms from being read by others. This builds trust and can also help with Google.
In future, the protection runs out sooner. So it should renew by itself.
With us, the protection renews by itself. It costs nothing extra.
A prospect types your business name into their phone, finds your website and taps the result. But instead of your home page, one word appears next to the address first: “Not secure”. For many people this triggers an uneasy feeling before they have read a single line. They tap “Back” and are returned to the results list – at the next provider. Around 68 percent (webupdater.de) of visitors leave a page as soon as the browser shows a security warning. That warning hangs on one small but decisive detail: the SSL certificate that turns an unencrypted HTTP connection into an encrypted HTTPS one. In 2026, HTTPS has long been the norm – already 95 percent (Google Transparency Report) of web traffic in Chrome runs encrypted. Anyone online without a certificate stands out for the wrong reasons. This article explains, in plain terms, what triggers the warning, why it costs trust and revenue, what changes for certificate lifetimes in 2026 and how a valid, automatically renewed certificate solves the problem for good – closely related to the broader topic of website security for small businesses.
Key takeaways
- The browser warning “Not secure” appears as soon as a page is served over HTTP without an SSL certificate – it sits right next to the address, before the first piece of content.
- Around 68 percent of visitors leave a page with a security warning; the exit happens in seconds and costs inquiries before anyone even sees your offer.
- SSL encrypts the connection, protects form entries from being read and is at the same time a ranking signal at Google – so HTTPS affects both trust and visibility.
- From 2026, certificates become much shorter-lived. Only automatic renewal keeps a site permanently valid – at Webstart this is included, at no extra charge.
What the Not Secure Warning Really Means
Every website is delivered over a protocol. Without an SSL certificate this happens over HTTP, and HTTP transmits all data in plain text. An SSL certificate (more precisely: TLS) enables HTTPS and encrypts the connection between the visitor's device and your server. Since July 2018, common browsers explicitly mark every plain HTTP page as “Not secure” (Google Chrome). This label is not a fault of your site in the narrow sense, but to a layperson it looks like a warning about fraud or viruses. The effect is immediate: the word sits in the most prominent spot of the window, right next to the address, and is read before your logo has loaded. With 95 percent (Google Transparency Report) of web traffic encrypted, an unencrypted page is the exception today – and stands out accordingly.
Visible Warning
The browser places “Not secure” right next to the address – before anyone reads the first heading. The first impression is thus negative from the start.
Instant Exit
Many visitors close the page at the sight of the warning instead of getting in touch or buying. The click back to the results list costs seconds.
Data in Plain Text
Without encryption, form entries travel openly across the network and are easier to read in transit – a real risk especially on public Wi-Fi.
Some perspective matters: an SSL certificate encrypts the transport path, but it does not replace other safeguards such as updates or backups. It ensures the connection between browser and server cannot easily be read or tampered with, and that the browser rates your site as trustworthy. For a small business this is exactly the point: you do not want to appear “insecure” when a customer visits you for the first time. How SSL fits into a rounded security concept with updates, backups and maintenance is covered in the article on website security for small businesses.
68 Percent Leave: Trust Decides
The economic core of the topic is trust. People decide online within seconds whether a page looks reputable, and the address bar is one of the first signals. Around 68 percent (webupdater.de) of visitors leave a page with a security warning – they never even read the content. It becomes even clearer when data is involved: in one survey, 84 percent (GlobalSign) of users said they would abandon a purchase if data were sent over an insecure connection, and 77 percent (GlobalSign) worry that their data could be intercepted or misused. For a trade business, a practice or a small shop this means: anyone online without SSL loses inquiries at exactly the point where prospects would otherwise get in touch.
The First Impression Comes Before the First Content
Trust is built from many small building blocks – a clean legal notice, real reviews, clear prices and, yes, a secure connection. Remove one of these blocks and the whole presence looks less reliable. Precisely because a valid certificate is standard today, its absence reads as a clear minus. Anyone who visibly plays it safe signals care, and visitors unconsciously transfer that care to the actual service. How a consistently trustworthy presence encourages inquiries is also shown in the article on the contact form with fewer fields and more inquiries.
HTTPS Is Standard – and Affects Rankings
HTTPS is not only a trust signal for people but also for search engines. Google officially declared HTTPS a ranking signal back in 2014 (Google) – encrypted pages have a small but real advantage in search. More importantly: if the certificate is missing, the negative effects of exits and weak trust can undo any ranking advantage. With 95 percent (Google Transparency Report) of traffic now encrypted, HTTPS is the expectation, not the exception. Then there is the legal side: anyone collecting personal data via a form must take appropriate technical measures under the General Data Protection Regulation – transport encryption is part of today's common state of the art. How to implement the basics of data protection for a small site is summarised in the article on GDPR basics for small websites.
- Padlock instead of warning: the browser shows the familiar symbol, the first impression is positive
- Encrypted transfer: form entries and contact details no longer travel across the network in plain text
- Ranking signal: Google has rated HTTPS positively since 2014 – a small but reliable factor (Google)
- Modern technology: fast protocols for shorter load times require an encrypted connection
- Legal basis: transport encryption is the common state of the art when collecting data
- Consistent presence: all pages run over https:// – no mix of secure and insecure addresses
A Padlock, Not a Miracle
2026: Shorter Lifetimes, Automatic Renewal
Until now a certificate was often valid for one to two years, later usually around 90 days. In 2026 a noticeable shortening begins. The non-profit certificate authority Let's Encrypt will offer, from May 2026, a profile that issues certificates lasting only 45 days (Let's Encrypt), initially optional for early adopters. From February 2027, the default lifetime drops to around 64 days (Let's Encrypt). In parallel, the responsible industry body is lowering the cap for public certificates step by step to 200 days from 2026, 100 days from 2027 and finally 47 days from 2029 (CA/Browser Forum). The reason is security: short lifetimes limit the damage if a certificate is compromised. But for you as an operator this has a practical consequence – renewing by hand becomes a constant, easily forgotten chore.
- Today: Let's Encrypt certificates are valid for around 90 days and are usually renewed before they expire (Let's Encrypt)
- From May 2026: an optional profile issues 45-day certificates – intended for early adopters and testing (Let's Encrypt)
- From February 2027: default issuance drops to around 64 days of validity (Let's Encrypt)
- Industry-wide: the cap for public certificates falls to 200 days (2026), 100 days (2027) and 47 days (2029) (CA/Browser Forum)
- Also available: very short certificates lasting just 6 days for heavily automated environments (Let's Encrypt)
The message behind this is clear: an SSL certificate is no longer a “set it up once and forget it” affair. The shorter the lifetime, the more often it must be renewed – and every missed deadline leads to exactly the warning you wanted to avoid. When a certificate expires, the browser jumps straight to “Not secure”, often on a weekend or during a holiday when no one is watching. The solution is automation: a system that requests, embeds and activates a new certificate in good time before expiry, without you having to intervene. This automatic renewal is the heart of a worry-free SSL setup – and a reason to get hosting and certificate from a single source, as described in the article on website maintenance and why it matters.
| Aspect | Site without SSL (HTTP) | Site with SSL (HTTPS, Webstart) |
|---|---|---|
| Browser address bar | “Not secure” warning next to the address | Padlock symbol and https:// |
| Data transfer | Form data travels in plain text | Connection encrypted, reading made harder |
| Visitor trust | Many leave immediately | Familiar, professional impression |
| Visibility at Google | HTTPS missing as a ranking signal | HTTPS counted as a signal |
| Certificate upkeep | Manual – easily expires unnoticed | Renewed automatically, before expiry |
| At Webstart | not included | Included in the fixed price and hosting |
Expired Is as Bad as Never Had One
The padlock in the address bar is the smallest trust question a website faces – and one of the first a visitor asks. Answer it with a valid certificate and you have cleared the first doubt before it even forms.
How Your Site Goes Online Securely
At Webstart the SSL certificate is a matter of course – at no extra charge and not as an add-on product. We set up the encrypted connection, make sure all addresses run over https:// and embed the automatic renewal so it runs in the background. You do not have to worry about lifetimes, renewals or deadlines. Combined with hosting in Germany and ongoing maintenance, your site stays continuously reachable and is shown as secure. What each service takes care of is laid out transparently in our overview of website maintenance and hosting.
Valid Certificate
Your site gets a recognised SSL certificate so browsers show the padlock instead of the warning – across all pages and subpages.
Automatic Renewal
The certificate renews itself before expiry – even as lifetimes shorten from 2026 and renewal is needed more often.
Hosting in Germany
We host your site on servers in Germany and keep the encryption current – without subscription lock-in and with a fixed personal contact.
For existing sites the switch from HTTP to HTTPS can usually be added without fuss: embed the certificate, change all internal links to https:// and cleanly redirect old HTTP addresses to the encrypted version, so no visitors and no search-engine signals are lost. Anyone thinking about a refresh anyway can combine this step with a website relaunch. Which package suits your scope is shown in the transparent overview of packages and prices – the certificate is always included.
An Honest Classification
Sources
Related Articles
Craft Business Website: Market Dates and Unique Pieces
A market calendar, one-off pieces with stock levels and a commission form: how a craft business sets up its website, with a clear line on withdrawal rights.
One page or several pages: what a starter site needs
When is a one-pager enough and when does a website need several pages? Three triggers for expanding, figures from Bavaria and a path to grow without a rebuild.
Website for Cleaning Companies: Win Contracts and Staff
Two entry points on one site: how a cleaning company gets enquiries by floor area and frequency and reaches applicants with clear hours and hourly pay.