Most small business sites need a basic domain validated certificate, which can be free, installed properly across the whole site. Extended validation costs more and adds the company name to the address bar, but the encryption is the same.

Three prices for one padlock

A business asking about a security certificate for its website can be quoted nothing, a modest yearly fee, or several hundred dollars a year.

The certificate is what puts the padlock in the address bar and lets the site load over HTTPS, so that what visitors type and see is encrypted on the way.

All three quotes can be honest. They are for different kinds of certificate, and the difference is not in the encryption.

It is in what the issuer checked before handing the certificate over, and in whether anyone visiting the site would ever notice.

The kinds on offer

The first is the one most small business sites need. It is issued automatically, often within minutes, and is available free from Let's Encrypt, which many hosts now build into their control panels.

What each one proves

A domain validated certificate proves that whoever requested it controls the domain, usually shown by placing a file on the site or answering an email sent to an address at the domain. It says nothing about who that is.

An organisation validated certificate adds a check of the business itself, against registration records. The name is written inside the certificate, where a visitor would have to click to read it.

Extended validation goes further, with paperwork that can take days. In return, the major desktop browsers show the verified company name in green beside the address.

The encryption itself is identical in all three.

What visitors actually see

For domain and organisation validated certificates, visitors see the same thing: a padlock and an address beginning with https.

Extended validation adds the company name, which is visible on a desktop screen. On a phone's narrow address bar it is easy to miss, and for many local businesses most visits now come from phones.

What visitors do notice is the absence of a padlock, particularly on a page asking for personal details. Google has also said that Chrome will eventually label plain HTTP pages as not secure.

Where the money goes

A paid domain validated certificate and a free one encrypt identically. The price buys convenience: a year or more between renewals, support from the seller, and a seal image to put in the footer.

Free certificates from Let's Encrypt last ninety days, which sounds short. They are designed to be renewed automatically, so on a host that supports them nobody has to do anything.

The warranty figures in certificate advertising cover mistakes by the issuer, under narrow conditions. They do not cover your site being hacked.

A worked example

A motorcycle dealer selling new and used bikes, with a service department and a parts counter, takes credit applications through a form on its website.

Last spring its finance manager asked for the company name in the address bar, the way the bank's site showed it. A reseller quoted an extended validation certificate at several hundred dollars a year, plus the time to gather documents.

Before buying, the dealer asked its web developer to look at what was already there. The site had a certificate bought years earlier, installed on the credit application page only.

That certificate covered the address without www, while the site's own links used the address with it, so some visitors met a warning.

And the photographs on that page came from the inventory supplier over plain HTTP, so even where the certificate matched, the padlock carried a warning.

The fix was a free certificate from the host covering both addresses and renewing itself, the whole site moved to HTTPS, and the photographs loaded securely. The extended validation quote was declined.

Installation matters more than the kind

Most certificate problems on small sites have nothing to do with which kind was bought. They come from how it was installed.

The certificate must cover every address the site answers to, with and without www. Every plain HTTP address should redirect to its HTTPS version, so there is only one site.

Every image, script and form on the page must load over HTTPS too, or browsers show a warning in place of the padlock.

And the certificate must renew before it expires. Once it lapses, browsers put up a full-page warning, and most visitors will not click past it.

When extended validation makes sense

There are cases for it. Businesses whose customers are often targeted by fake copies of their site, such as banks and payment services, use the company name as one more sign that the page is real.

A business with a large online store might decide the name is worth the cost and the paperwork.

For a dealer, a clinic, a trade or a shop taking enquiries, the money is better spent on getting the installation right and keeping the site updated.

Questions to ask a seller

When a certificate is offered, a few questions sort out what is being sold.

Ask which kind it is and what the issuer checks. Ask whether it covers the address with and without www, how it renews, and who is warned before it expires.

Ask whether your host already provides certificates. Many do, and the paid one may duplicate it.

And ask who will install it, move the site over and check every page afterwards, because that is the part that decides whether the padlock appears.

The counter-case

A free certificate is not always the simplest choice. Some older hosting plans cannot use them, and some older systems need each renewal installed by hand.

In those cases a paid certificate with a longer life can save trouble, although a hosting plan that cannot use free certificates is worth reviewing for other reasons.

For most small business sites the advice stands: a basic certificate, properly installed across the whole site, renewing on its own.

Before buying

  1. Ask your host whether certificates are included.
  2. Check both addresses, with and without www.
  3. Redirect every page to HTTPS.
  4. Fix insecure images and scripts.
  5. Confirm renewal is automatic.
  6. Add the HTTPS version to Search Console.
  7. Spend the difference on the installation.

Step five is the one that fails quietly. A certificate that expires over a weekend shows every visitor a full-page warning until someone notices on Monday.

Installing it needs the hosting login, which brings back passwords from the developer's handover email.

Frequently asked questions

Do expensive certificates encrypt better?

No. Domain validated, organisation validated and extended validation certificates all encrypt the connection the same way. The difference is what the issuer checked before issuing.

What does extended validation add?

Stricter checks on the business, and the company name shown in green beside the address in desktop browsers. On a phone it is easy to miss.

Are free certificates good enough?

For most small business sites, yes. Let's Encrypt certificates last ninety days and are designed to renew automatically, and many hosts now include them.

What does the certificate warranty cover?

Mistakes by the issuer, under narrow conditions. It does not cover your website being hacked or anything else that happens on the site itself.

Why does my padlock show a warning?

Usually because an image, script or form on the page still loads over plain HTTP, or the certificate does not cover the address the visitor used.

When is extended validation worth paying for?

For businesses whose customers are targeted by fake copies of their site, such as banks and payment services. For most small businesses, the installation matters more.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Quoted for a certificate you may not need?

Forward us the quote along with your website address, and we will check what your host already includes.

Start a Conversation