The small padlock in the address bar is not a technical detail: it shows that the connection between your visitor and your site is encrypted. Without it, the browser displays "Not secure", and a share of your prospects turn back before they even read you. Moving your site to HTTPS reassures your customers and improves your position in Google.

Google makes no secret of it. As early as August 2014, the company announced on its security blog that HTTPS had become a ranking signal. Since July 2018, its Chrome browser marks any site still on HTTP as "Not secure". As a result, according to Google's Transparency Report, more than 90% of the pages loaded in Chrome now use an encrypted connection.

For a Belgian SME, the stakes are twofold. A site seen as "not secure" loses credibility with customers used to the standards of large sites. And the GDPR requires appropriate security measures as soon as you handle personal data: a simple contact form is enough to be concerned. HTTPS is no longer an option, it is the minimum expected.

The padlock, a trust signal for your visitors

Before reading your offer, a visitor judges your site in a few seconds. A "Not secure" warning in the address bar sends a clear message: this site does not protect your data. On a contact form, a booking or a payment page, that doubt is enough to drive people away.

The closed padlock, on the other hand, shows that the information exchanged (name, email, message, bank details) travels encrypted and cannot be read in plain text by a third party. It is a technical guarantee, not a decoration.

Be careful, though, not to make it say too much. The FBI pointed out in a public warning that the padlock does not prove a site is honest: fraudulent sites use HTTPS too to appear legitimate. So the padlock remains a prerequisite for trust, not a quality label. Its absence, however, is noticed immediately.

HTTPS and search ranking: what Google really looks at

HTTPS is a ranking signal confirmed by Google since 2014. With equal content, a secure site starts with a slight advantage over a site still on HTTP. The weight of this signal remains moderate (content relevance matters far more), but in a competitive sector, every criterion ends up counting.

The real risk is not the missing bonus, it is the negative signal sent to your visitors and the bounce rate that climbs. A site marked "not secure" drives people away before converting, and this behaviour shows up in your positions. To understand how the engine assesses your pages, our articles on the basics of natural search optimisation and on the speed of your site usefully complete this point.

Moving your site to HTTPS without making life hard

Good news: securing a site costs very little today, or even nothing. An SSL certificate, the file that activates HTTPS, is often included by serious hosting providers. The non-profit Let's Encrypt issues them for free and secures hundreds of millions of them worldwide.

The key steps:

• Install a valid SSL certificate on your domain name and its subdomains.

• Automatically redirect all HTTP addresses to their HTTPS version (301 redirect), so you do not keep two versions of the site.

• Fix "mixed content": images, scripts or fonts still called over HTTP, which break the padlock even on a secure page.

• Update your internal links, your sitemap and Google Search Console to the HTTPS version.

On the compliance side, the GDPR (article 32) requires appropriate security measures to protect personal data. Encrypting exchanges via HTTPS is part of that, and the Belgian Data Protection Authority expects this kind of basic measure. HTTPS therefore serves your customers as much as your compliance.

If you are starting a redesign or a new website creation, plan for HTTPS from the start, never added afterwards.

Frequently asked questions

Is an SSL certificate really free?

Yes, in most cases. Let's Encrypt issues free certificates that renew automatically, more than enough for a showcase site or a small online shop. Paid certificates only add value for specific needs, such as extended guarantees or organisation validation.

"Not secure" appears even though I have a certificate, why?

It is almost always a mixed content problem: part of the page (image, script, font) is still loaded over HTTP. The browser then treats the page as partially insecure. You need to find and fix these calls so the padlock closes again.

Can switching to HTTPS make my ranking drop?

Not if the migration is clean. The risk comes from a forgotten or badly done redirect, which creates duplicate pages or broken links. With correct 301 redirects and a Search Console update, the transition happens without loss, often with a slight gain.

Priority action plan

1. Check your padlock: open your site in Chrome and look at the address bar. A "Not secure" or a crossed-out padlock calls for immediate action.

2. Install or activate an SSL certificate: through your hosting provider or Let's Encrypt, on your main domain and its subdomains.

3. Force HTTPS everywhere: 301 redirect from all HTTP to HTTPS, and hunt down mixed content until the padlock is closed on every page.

4. Tell Google: declare the HTTPS version in Search Console and update your sitemap to speed up its processing.

HTTPS is not a project, it is a box to tick, but a box that too many SME sites still leave empty. Sorting it out often takes less than a day, and it protects your customers, your data and your visibility all at once. It is the kind of invisible foundation that only gets noticed when it is missing.

Unsure about your site's padlock? We secure the website creation of Belgian SMEs and move it to HTTPS, cleanly and without downtime.