Guide · Building & launching
HTTPS and SSL certificates: what businesses need to know
HTTPS encrypts the connection between a visitor's browser and your website, so that passwords, form data and payment details cannot be read or altered on the way. Browsers mark sites without HTTPS as "Not secure", payment providers require it, and search engines prefer secure pages. For a business website today, HTTPS is not optional. The good news: it is usually free and can be fully automated.
[ 01 ]
In short
In short
- 01
HTTPS uses a TLS certificate (still commonly called an SSL certificate) issued by a certificate authority.
- 02
Free certificates with automatic renewal are sufficient for most business websites.
- 03
Every version of the site should redirect to one HTTPS address.
- 04
Mixed content — insecure images or scripts on a secure page — must be removed.
- 05
Monitor certificate expiry; an expired certificate blocks visitors with a full-page warning.
[ 02 ]
Guide
What a certificate does
A certificate proves to the browser that the site it is talking to really controls the domain, and enables encryption of the connection. It is issued by a certificate authority after verifying control of the domain, and it expires after a set period, after which it must be renewed.
Types of certificates
- Domain validated (DV) — confirms control of the domain. Issued quickly, often free, suitable for most sites.
- Organisation validated (OV) and extended validation (EV) — include verification of the organisation. Browsers no longer display them differently to most users, so their practical benefit for ordinary websites is limited.
- Wildcard — covers all subdomains of a domain (
*.example.az). - Multi-domain — covers several different domains in one certificate.
For most business websites, a free DV certificate with automatic renewal is the right choice.
Setting up HTTPS correctly
- Install the certificate on the server or CDN.
- Redirect all HTTP requests to HTTPS with a permanent (301) redirect.
- Choose one main version — with or without
www— and redirect the other. - Update internal links, canonical tags and the sitemap to HTTPS addresses.
- Fix mixed content: images, scripts, fonts and embeds loaded over HTTP.
- Consider HSTS (HTTP Strict Transport Security), which tells browsers to always use HTTPS for your domain. Enable it once HTTPS works everywhere, including subdomains if you include them.
Automatic renewal
Certificate lifetimes have been getting shorter across the industry, which makes manual renewal risky. Use automatic renewal — most hosting providers and CDNs offer it — and set up monitoring that warns you weeks before expiry in case automation fails. See 24/7 monitoring.
Common mistakes
- Expired certificate after a failed renewal — visitors see a warning and leave.
- Certificate for the wrong name — issued for
example.azbut the site is opened atwww.example.az. - Mixed content — the padlock disappears or elements fail to load.
- Redirect loops between HTTP and HTTPS, often caused by a CDN and server configured differently.
- Forgotten subdomains — a shop, blog or client portal on a subdomain without HTTPS.
HTTPS is not complete security
HTTPS protects data in transit. It does not protect a site from vulnerable software, weak passwords or malicious scripts. A padlock on a phishing site only means the connection to the phishing site is encrypted. See security checklist before launch.
[ 03 ]
FAQ
Frequently asked questions
Do we need a paid certificate?
For most websites, no. Free certificates provide the same encryption. Paid certificates may come with warranties or support, or be required by specific corporate policies.
Does HTTPS affect SEO?
Google has used HTTPS as a lightweight ranking signal since 2014, and browsers warn users about non-HTTPS pages. The bigger effect is on trust and conversions.
Our site has no forms. Does it still need HTTPS?
Yes. Browsers mark all HTTP pages as not secure, and HTTPS also prevents third parties from injecting content into your pages.