An SSL/TLS certificate proves your website is really yours and scrambles the data between visitor and site. It shows as HTTPS and a padlock in the address bar. Without it, passwords and form entries can be read or altered on the way, and browsers warn visitors when a certificate is missing or invalid.
What is an SSL/TLS certificate?
The certificate is a digital file that proves a website’s identity and lets the browser and the server encrypt the traffic between them. Most people leave at the browser warning.
A certificate links a domain nameA domain name is the address people type to reach your website, such as yourcompany.com. It points visitors to wherever your site is hosted. to a secret key that your server holds. A trusted organization called a certificate authority checks that you control the domain and then signs the certificate. When a browser connects, it checks the signature, checks that the name matches the address and then agrees on encryption keys with the server.
SSL is the old name. The technology is now called TLS, and older versions of both SSL and early TLS have been retired. The name SSL certificate stuck, which is why you will see both terms used for the same file.
What it means for a PHP or WordPress site
The certificate is installed on the server or at the edge in front of it, not inside PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it.. Many hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. providers set one up automatically and renew it in the background, often using the free service Let’s Encrypt. On a basic plan you may have to switch it on in the hosting panel.
Three things go wrong most often. The certificate expires because the automatic renewal failed. The certificate does not match the name, for example it covers the address without www but not the address with it. Or the site still has links and images that point to http addresses, which causes mixed-content warnings.
For WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits., the site address in the settings must start with https, otherwise the site keeps generating http links. And when PHP fetches data from other servers over HTTPS, for example with cURLcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order., it should verify the other side’s certificate. Switching verification off to make an error disappear removes the protection the certificate is there to give.
How to check your certificate
Click the padlock next to the address in your browser and open the certificate details. You see who issued it, for which names it is valid and until when. Write the expiry date in your calendar if renewal is not automatic. A DNSDNS is the internet's phone book: it looks up a domain name, such as yourcompany.com, and tells browsers which computer holds that website. change or a move to a new server often means the certificate has to be issued again for the new setup, so check right after a migration.
The certificate protects the connection. Further browser protections, such as HSTS, are set through security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on. on top of it.
When to act
Act at once when visitors see a certificate warning, because it blocks them from reaching the site. Act soon when the expiry date is close and renewal is not automatic. If a warning appears together with other errors after an update or a move, a broken configuration is a likely cause, and our emergency help for a website down situation can find and repair it. Keep in mind that a valid certificate does not make an outdated PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. safe; that needs an update.
Frequently asked questions
What is the difference between SSL and TLS?
TLS is the newer version of the technology that began as SSL. The old SSL versions are retired and should not be used. People still say SSL certificate out of habit, but the connection itself runs on TLS.
Why does my browser say my site is not secure?
Common causes are an expired certificate, a certificate issued for a different domain name, or a page that loads some files over plain http. Check the certificate details in the browser first, then the settings of your site.
Does HTTPS mean my site cannot be hacked?
No. HTTPS protects the connection between visitor and server, so others cannot read or change the traffic on the way. It says nothing about whether the site itself is up to date or free of vulnerabilities.