SSL Certificates for Online Stores: Why They Are Mandatory

Introduction

If you’re going to open an online store, the SSL certificate isn’t an option: it’s a requirement. Without SSL you can’t charge securely, browsers warn that your site “isn’t secure,” and in many countries you’d be violating data protection law.

In this article you’ll see what SSL is, why it’s essential in an online store, and how to make sure it’s properly configured.

What an SSL certificate is (in plain words)

An SSL certificate is a small file installed on your hosting that does two things:

1. Encrypts the data traveling between the website and the customer’s browser. No one can intercept it.
2. Displays the security padlock in the browser and enables your address to start with https:// instead of http://.

[Imagen sugerida: screenshot of the security padlock in the browser with https]

When a website has SSL, the browser shows it as “secure.” When it doesn’t, it shows a “not secure” warning, which scares customers away.

Why SSL is mandatory in an online store

1. It protects your customers’ data

In an online store, the customer enters sensitive data: name, address, phone number and, above all, payment information. Without SSL, this data travels unencrypted and anyone could intercept it.

2. Payment gateways require it

No serious payment gateway works without SSL. Stripe, PayPal, MercadoPago and any virtual POS require your site to load with https://. Without SSL, the gateway simply won’t activate.

3. It avoids the “not secure” warning

Modern browsers (Chrome, Firefox, Safari, Edge) mark any website without SSL as “not secure.” Imagine a customer about to pay seeing that warning: most likely they’ll abandon the purchase.

4. It complies with data protection regulations

In Spain and the European Union, data protection regulations (GDPR) require personal data to travel encrypted. Selling online without SSL is a legal violation that can lead to penalties.

5. It improves your SEO

Google gives preference in its results to websites with SSL. A store without HTTPS loses Google positions to competitors that have it.

[Imagen sugerida: visual comparison between a website with http (not secure warning) and one with https (green padlock)]

How to check if your store has SSL active

It’s very simple:

1. Open your store in the browser.
2. Look at the address bar.
3. If you see a closed padlock and the address starts with https://, SSL is active.
4. If “not secure” appears or the address starts with http://, you don’t have SSL or it’s not configured correctly.

At miHosting all hosting plans include a free Let’s Encrypt SSL certificate, installed and renewed automatically. You don’t have to do anything to have it.

How to activate SSL in your store

In cPanel

1. Log in to cPanel.
2. Find the SSL/TLS section.
3. Activate the Let’s Encrypt certificate for your domain.
4. Wait a few minutes for it to install.

In DirectAdmin

1. Log in to DirectAdmin.
2. Go to SSL Certificates.
3. Activate Let’s Encrypt for your domain.

Force HTTPS in your store

Having the certificate installed isn’t enough. You must ensure the entire site loads with https://. This is called forcing HTTPS.

• In WordPress and WooCommerce, you can use a plugin like Really Simple SSL that configures it automatically.
• In PrestaShop, go to Shop Parameters → Traffic & SEO and enable the HTTPS option.
• In Magento, configure the secure URL under Stores → Configuration → Web.

If you need help forcing HTTPS correctly, we have a specific guide on how to do it safely.

The mixed content problem

Sometimes, even though you have SSL installed, the browser still shows warnings. The most common cause is mixed content: some images, files or scripts on your site still load over http:// instead of https://.

To fix it:

1. Check that all images on your site use paths with https://.
2. Check that plugins or modules load their resources over HTTPS.
3. Use a tool like Why No Padlock to detect which resources cause the problem.

[Imagen sugerida: screenshot of the Why No Padlock tool detecting mixed content]

Types of SSL certificates

Not all SSL certificates are the same. These are the main types:

Type	Validation	What it’s for
DV (Domain Validation)	Only verifies the domain	Sufficient for most stores. Let’s Encrypt is this type.
OV (Organization Validation)	Verifies the company	Shows the company name in the certificate. More trust.
EV (Extended Validation)	Full verification	Previously showed the green bar with the company name. Maximum trust.
Wildcard	Covers subdomains	A single certificate protects *.yourdomain.com. Ideal for projects with subdomains.

For an online store, the DV certificate from Let’s Encrypt is sufficient and free. If you want to convey more visible trust, you can opt for an OV or Wildcard certificate.

Useful tips

• Activate SSL before adding products. Configuring it at the start prevents mixed content problems later.
• Check SSL after every major change. An update or new plugin can break HTTPS.
• Renew SSL automatically. Let’s Encrypt certificates last 90 days. At miHosting renewal is automatic.
• Don’t mix HTTP and HTTPS. Your entire site must load with HTTPS, without exceptions.
• Back up before forcing HTTPS. If something goes wrong, you can go back.

Common problems

My store shows “not secure” even though I have SSL

It’s a mixed content issue or HTTPS not being forced. Check that the entire site loads with https:// and use a tool like Why No Padlock to detect the problem.

The padlock doesn’t appear on all pages

Some pages may have resources loading over HTTP. Check each type of page (home, product, checkout) separately.

The payment gateway gives an SSL error

Verify that your SSL is active and there’s no mixed content on the checkout page. Payment gateways are especially strict about this.

The certificate appears expired

Let’s Encrypt certificates last 90 days. Renewal should be automatic. If it isn’t, contact your hosting to enable automatic renewal.

When forcing HTTPS, the site doesn’t load

It may be a redirect issue. Review the .htaccess file or the configuration of the plugin you’re using to force HTTPS.

Frequently asked questions

Is Let’s Encrypt’s SSL as secure as a paid one?

The encryption level is exactly the same (256-bit). The difference is that Let’s Encrypt only offers domain validation (DV), while paid certificates can include organization validation (OV) or extended validation (EV).

How much does an SSL certificate cost?

It can be free (Let’s Encrypt) or have an annual cost depending on the type. At miHosting, SSL is included in all plans at no extra cost.

Do I need a different SSL for each domain?

If you have several domains, you need a certificate for each one, or a multi-domain (SAN) certificate that covers several at once. Wildcard certificates cover all subdomains of a domain.

Does SSL expire?

Yes. Certificates have an expiration date. Let’s Encrypt lasts 90 days and renews automatically. Paid certificates usually last 1 year.

Can I sell without SSL using an external gateway?

Even if the gateway processes payment on its own page, your site still needs SSL to protect customer data during browsing and checkout. Selling without SSL isn’t recommended.

No SSL, no online store

The SSL certificate is an essential piece of any online store. It protects your customers’ data, enables payment gateways, avoids “not secure” warnings, complies with data protection regulations and improves your SEO.

If you don’t yet have SSL or need help configuring it correctly, at miHosting all plans include a free Let’s Encrypt SSL certificate, installed and renewed automatically. Our technical team can help you force HTTPS and resolve any mixed content issues. Open a ticket from your client panel and we’ll help.