TL;DR: You almost never need to buy a website SSL certificate in 2026. Website builders like Wix, Squarespace and WebZum include one for free, and so do most hosts. When we checked 40 local service business websites, not one used a paid certificate. All 38 working sites used free ones that renew on their own. What changed this year is renewal, not price. Since March 15, 2026, no public certificate can last longer than 200 days, and that drops to 47 days by 2029. Chrome 154 (October 2026) also asks visitors for permission before opening a public site without HTTPS. So the thing to care about is whether someone renews your certificate automatically. With WebZum, every site gets its certificate set up and renewed for you, with nothing to buy or install.
See your site free, certificate included →
Disclosure: WebZum publishes this blog and makes an AI website builder. Facts about the CA/Browser Forum, Let’s Encrypt, Google, GoDaddy, Wix and Squarespace come from their own pages, linked inline. The 40-site certificate check below is our own.
Verified October 30, 2026.
Do I need to buy an SSL certificate for my website?
Usually not. An SSL certificate (technically a TLS certificate today) is what lets your site load over HTTPS, so the connection between a visitor and your site is encrypted. Every business site needs one. Almost no small business needs to pay for one.
Free certificates come from certificate authorities like Let’s Encrypt and Google Trust Services, and most builders and hosts install them for you:
- Wix: “All sites created on Wix have HTTPS automatically enabled at no additional cost.” A custom domain needs a paid Wix plan, but the certificate is still free. You can’t turn SSL off, and you can’t bring your own certificate (Wix Help).
- Squarespace: “All domains correctly pointing to your Squarespace site are automatically protected with free SSL certificates” (Squarespace Help).
- GoDaddy sells certificates, but its own SSL page also says some of its annual hosting plans come with a free one (GoDaddy SSL page).
A free domain-validated (DV) certificate and a paid DV certificate do the same job. Both prove you control the domain, and both encrypt the connection the same way. The visitor sees the same thing either way.
What does a paid SSL certificate cost?
On GoDaddy’s US site, the basic DV certificate is listed at $5.99/mo with a 3-year term. GoDaddy describes it as one “you install and manage manually,” including “manual re-installation and troubleshooting 2+ times per year.” Its Automated DV option is $7.99/mo and Fully-managed DV is $9.99/mo, both with 3-year terms (GoDaddy, prices checked October 30, 2026). On GoDaddy’s US Spanish-language page for the same $5.99 certificate, the 3-year term is $215.64 up front and renews at $359.97 (GoDaddy).
That’s real money for something most website platforms give you, and the basic tier still leaves the reinstalling to you.
What changed for SSL certificates in 2026?
Two things: certificates got shorter, and Chrome got stricter.
Certificates now expire faster. In April 2025, the CA/Browser Forum, the group of certificate authorities and browser makers that sets the rules, passed ballot SC-081v3. It cuts the maximum life of a public certificate from 398 days to 47 days in steps from March 2026 to March 2029 (CA/Browser Forum). The vote was 25 certificate issuers in favor and none against, including GoDaddy, DigiCert, Sectigo and Amazon, and Apple, Google, Microsoft and Mozilla all voted yes.
The schedule, as the California Department of Technology summarized it: 200 days from March 15, 2026, 100 days in 2027, and 47 days by 2029 (California Department of Technology).
Let’s Encrypt, the biggest free issuer, is moving faster than the cap. Its default certificates go from 90 days to 64 days on February 10, 2027, and to 45 days on February 16, 2028 (Let’s Encrypt, Let’s Encrypt). Its advice is blunt: “Manually renewing certificates is not recommended, as it will need to be done more frequently with shorter certificate lifetimes.” It also stopped sending expiration reminder emails on June 4, 2025 (Let’s Encrypt), so nobody is going to warn you by email anymore.
Chrome now warns before sites without HTTPS. Google announced that “with the release of Chrome 154 in October 2026, we will change the default settings of Chrome to enable ‘Always Use Secure Connections’. This means Chrome will ask for the user’s permission before the first access to any public site without HTTPS” (Google Security Blog). In the same post, Google’s numbers showed how rare plain HTTP already was on public sites: about 98% of page loads over HTTPS on Windows and over 99% on Mac and Android.
Chrome’s guide for site owners adds that Chrome remembers a visitor’s choice to continue for 15 days, and that warnings for expired or misconfigured certificates stay as they were (Chromium docs). Those are the full-page red warnings, and most people back out.
Put together: a certificate someone renews by hand a few times a year is now a chore that will keep getting more frequent, and a missed renewal shows customers a warning page instead of your business.
What did we find when we checked 40 local business websites?
On October 30, 2026, we checked the certificates on 40 US local service business websites (contractors, auto shops, HVAC, cleaners and similar family businesses in six metro areas) plus 8 WebZum demo sites. We connected to each domain and read the certificate it served. We picked the sites by hand, so this is a snapshot, not a random survey, and we’re not naming anyone.
| What we found | Count |
|---|---|
| Sites serving a working certificate | 38 of 40 |
| Sites using a paid certificate | 0 of 40 |
| Free Let’s Encrypt certificates | 32 |
| Free Google Trust Services certificates | 6 |
| Working certificates with an 89 to 90 day life (renewed automatically) | 38 of 38 |
| Sites with a broken certificate setup | 2 of 40 |
Every working site was on a free certificate that its host or builder renews automatically. Nobody in the sample was paying for one.
The two broken sites are the useful part:
- An HVAC company was serving its shared host’s generic certificate, issued for the hosting company’s name, not the business’s. That certificate expired on July 3, 2026. Anyone who has typed in that company’s address since then has seen a full-page warning instead of the website, for about four months.
- An auto repair shop didn’t answer on HTTPS at all. With Chrome 154, visitors now get asked whether they really want to open it.
Neither problem would be fixed by buying a certificate. Both are setup and renewal problems.
The 8 WebZum demo sites all served a valid Amazon-issued certificate with a 197-day life, inside the 200-day cap, good until February 19, 2027. WebZum issues and renews these through Amazon’s certificate service, which handles renewal automatically (AWS Certificate Manager docs). We wrote up how that works in how we automated custom domain setup and SSL.
When does a paid SSL certificate make sense?
There are a few honest cases:
- You need your organization’s verified name inside the certificate. Organization Validated (OV) and Extended Validation (EV) certificates check your business’s identity, not just control of the domain. Some banks, large ecommerce stores, and companies with security reviews ask for them.
- Your host doesn’t offer free certificates. Then you’re paying either way. It may be a sign to change hosts.
- You run unusual setups, like many subdomains on servers you manage yourself.
A paid certificate is not a ranking boost. Google lists “Are your pages served in a secure fashion?” in its page experience self-check, but also says that “beyond Core Web Vitals, other page experience aspects don’t directly help your website rank higher” (Google Search Central). HTTPS matters for trust and for avoiding warnings. Paying for the certificate doesn’t change how Google ranks you.
How do you check your website’s SSL certificate?
It takes about a minute in Chrome:
- Open your site and click the small icon just left of the web address. Current Chrome shows a two-slider icon there, not a padlock.
- You should see “Connection is secure.” If you see “Not secure” or a full-page warning, something is wrong.
- Click “Connection is secure,” then “Certificate is valid” to open the certificate viewer. Look at who issued it and the expiration date.
- Note whether that date is in the next few weeks, and find out who renews it. If the answer is “I’m not sure,” that’s the risk.
Also try your address both with and without www. Each version needs to be covered.
How do website builders and hosts compare on SSL?
| Option | Certificate cost | Who renews it | What you do |
|---|---|---|---|
| GoDaddy basic DV SSL | $5.99/mo on a 3-year term | You, by hand (GoDaddy says 2+ reinstalls a year) | Install and reinstall it yourself |
| GoDaddy Fully-managed DV SSL | $9.99/mo on a 3-year term | GoDaddy | Pay for it separately from hosting |
| Self-hosted site with Let’s Encrypt | Free | Your server, if automation is set up | Set up and watch the automation |
| Wix | Free with every site | Wix | Nothing |
| Squarespace | Free when the domain points to Squarespace | Squarespace | Nothing |
| WebZum | Included on every site | WebZum | Nothing |
Wix and Squarespace handle this well too. If you’re already happy on one of them, your certificate isn’t a reason to move. If you’re paying GoDaddy for a separate certificate and reinstalling it, it might be.
How does WebZum handle SSL certificates?
Every WebZum site gets an SSL certificate that’s set up and renewed automatically. You don’t buy one, install one, or watch an expiration date.
- Your free preview is already on HTTPS at a webzum.com address.
- Basic ($19/mo) keeps your site live on its webzum.com address, with HTTPS.
- Professional ($34/mo) adds a custom domain. WebZum can register one for you, or you can connect a domain you already own, and the certificate and DNS records are set up for you. If you also want email at that domain, see how to get a business email address.
There are no certificate add-ons and no “security package” upsell. It’s part of the site, like the pages are.
If you’re shopping around because a host wants extra for SSL, see what website hosting should cost, cheap website hosting that includes the basics, or WebZum vs GoDaddy. If you still need a name, start with how to buy a domain name.
FAQ
Do I need a website SSL certificate?
Yes, your site needs one, but you probably don’t need to buy one. Most builders and hosts include a free certificate and renew it automatically. In our check of 40 local business sites, none paid for a certificate.
Is a free SSL certificate as secure as a paid one?
For a normal business site, yes. A free DV certificate from Let’s Encrypt or Google Trust Services uses the same encryption as a paid DV certificate. Paid OV and EV certificates add identity checks on your organization, not stronger encryption.
Does an SSL certificate help SEO?
HTTPS is part of Google’s page experience checklist, but Google says page experience aspects beyond Core Web Vitals don’t directly help a site rank higher. The real cost of missing HTTPS is visitors seeing a warning and leaving, especially now that Chrome 154 asks before opening non-HTTPS sites.
How long does an SSL certificate last now?
Since March 15, 2026, at most 200 days. That drops to 100 days in 2027 and 47 days by 2029. Let’s Encrypt’s free certificates last 90 days today and will move to 64 days in February 2027.
Why does my website say “Not secure”?
Usually the site isn’t using HTTPS, the certificate expired, or the certificate doesn’t match the address (for example, it covers www but not the plain domain). Check the certificate in Chrome as described above, then ask your host or builder who is supposed to renew it.
Does WebZum include an SSL certificate?
Yes. Every WebZum site gets an SSL certificate that’s set up and renewed automatically, including the free preview. Connecting your own domain is on the Professional plan ($34/mo, month to month).
See your site with the certificate already on it
You can spend a few minutes worrying about certificate types, or about five minutes getting a finished website where that’s handled for you. Tell WebZum your business name, where you work and how customers reach you, and you’ll get a multi-page site on HTTPS to look at before you pay anything.