SSL (more precisely TLS) is the technology behind the padlock and https:// in the address bar. For a small website — bakery hours, portfolio, résumé — it is not theater and not only for credit cards. It protects the trip between the visitor’s browser and your host from casual snooping and tampering on rough networks, and it keeps browsers from painting your site with scary warnings. Here is what matters on SiteHost without a cryptography lecture or a $70 “premium seal” upsell.
What SSL/TLS does for a brochure site
When HTTPS works:
- Traffic is encrypted in transit
- Visitors see fewer interstitial warnings
- Modern embeds and browser features often expect a secure context
- Customers feel a baseline professionalism even when you only list hours
When HTTPS fails or mixes insecure assets:
- Browsers warn or block content
- Forms feel sketchy even if you never collect passwords
- Ad platforms may refuse destinations
SiteHost provides HTTPS on the preview URL immediately after publish. For your custom domain, the certificate is issued after DNS verifies. That sequencing is intentional: the host must see the name point here before trusting a certificate for it. How to point DNS to website hosting, connect a domain to your website.
Skip paying separate legacy “SSL certificate” upsells for a basic site on a modern host that already automates issuance. Pay for hosting; expect HTTPS to be part of the path.
“Free SSL” in marketing speak
Many hosts advertise free SSL because certificate issuance via modern public certificate authorities is automated and included. You should not need a separate yearly SSL product for a normal small site in today’s hosting market. SiteHost includes appropriate certificates as part of hosting — preview right away, custom domain after DNS — not as a suspicious add-on pack.
You still pay for hosting itself: Starter $9/mo (1 site, 2 GB), Pro $30 (3 sites, 10 GB, staging), Scale $65 (10 sites, 30 GB), Business $130 (30 sites, 100 GB, teams). Trial ~1 day, then paid. SSL is not a reason to chase a forever-free host with other sharp edges. Affordable hosting for a small website.
Mixed content — the quiet breaker
Mixed content means an HTTPS page loads images, scripts, or iframes over plain http://. Browsers may block the asset or show a broken padlock.
Fix patterns:
- Change embeds to
https:// - Use relative URLs for your own assets (
images/hero.jpgor/images/hero.jpg) - Re-export third-party widgets with secure embed codes
- Search your HTML for
http://before launch
Failure mode: padlock looks fine on Home, broken only on Contact because the map embed is ancient. Spot-check every template on phone and desktop. How to publish a website online.
What SSL is not
- Not a firewall for your laptop
- Not malware scanning of the HTML you uploaded
- Not DDoS protection by itself (optional Cloudflare can add edge features; SiteHost has no built-in CDN)
- Not proof your business is honest — certificates relate to cryptographic identity of the connection/name path, not moral character
- Not a substitute for strong passwords on your SiteHost account or registrar
Do not buy animated “SSL seals” from random upsell vendors. The browser chrome is the signal customers understand.
Practical checklist on SiteHost
- Publish files; open preview via
https://— confirm the padlock. - Fix mixed content on preview.
- Point DNS for the custom domain using the records SiteHost shows.
- Wait for verification and certificate issuance.
- Open
https://yourdomain.com(andwwwif you use it); retest forms and embeds. - Prefer HTTPS URLs in ads, Google Business Profile, and printed materials once ready.
Rollback of files will not fix a DNS or certificate delay. Different layers. How to make a website live.
HTTP to HTTPS habits for small teams
Update old marketing PDFs and signatures that still say http://. Ask partners to fix inbound links when you can. After cutover, if someone hits stale HTTP, browsers and hosts often redirect — still aim to publish correct HTTPS links so you are not relying on forgiveness.
If you use Cloudflare in front, understand whether the proxy is on and how it affects certificate visibility. Optional means you can succeed without it.
Example: craft fair organizer
A weekend market landing page used an old HTTP map embed. On preview HTTPS, the map was blank on phones. Switching to the provider’s HTTPS embed restored it. The custom domain certificate issued after DNS verified — no one purchased a $70 “premium SSL” from a spammy email. Ads went live only after https:// on the public name looked clean. Form submissions continued through a third-party form tool; SiteHost never needed to be a mail host.
Common support confusions
| Symptom | Likely layer |
|---|---|
| Preview padlock fine, domain warns | DNS not verified / cert not issued yet |
| Padlock broken on one page | Mixed content on that template |
| Works on phone, not office Wi‑Fi | Local DNS cache / proxy |
| “Not secure” on HTTP bookmark | Update the bookmark to HTTPS |
Talking to non-technical stakeholders about the padlock
Say: “The preview link is already secure. When we point the domain, SiteHost issues a certificate after DNS checks out. We will not buy a separate scary SSL upsell. We will fix any old http embeds so the padlock stays happy.” Then show them a mixed-content break on purpose in staging if they learn visually.
Certificate timelines without anxiety spirals
After you save correct DNS records, verification may be quick or may take longer because of TTL and caches. Use the HTTPS preview for demos meanwhile. Do not announce the custom domain on a billboard until you personally open https://yourdomain.com and see a calm padlock.
If issuance seems stuck, re-check record type and target, confirm you edited the DNS host that your nameservers actually use, and avoid toggling Cloudflare proxy modes every few minutes. SiteHost Starter through Business all follow the same certificate-after-DNS pattern. Mixed content remains your HTML’s responsibility.
Questions people actually ask
Do I need to generate a CSR by hand?
Not on SiteHost’s standard path. Follow the domain UI; issuance is handled after DNS verifies.
Can I upload my own certificate file?
The standard path is managed certificates. Unusual compliance needs are a support conversation — most small sites should not DIY cert files.
Is plain HTTP ever okay for a public site?
Browsers are phasing out comfort with plain HTTP. Serve HTTPS.
Does SSL make my site faster?
TLS cost is negligible compared with a 3 MB hero image. Speed work starts with images (fast-loading website hosting).
Why is preview secure but my domain not yet?
Preview uses a host-controlled name. Your domain needs DNS verification first. Patience plus correct records.