SSL and HTTPS: why your site needs a certificate and how to get one
Without HTTPS the browser writes 'Not secure' next to your address in plain words. That costs you enquiries before anyone sees the first screen.
What the certificate actually does
SSL encrypts the channel between the visitor's browser and your server. Without it, everything typed into a form travels the network in clear text and can be intercepted at any hop, including mall Wi-Fi.
For a shop taking card payments through Payme or Click it is not optional: payment providers will not connect a site served over plain HTTP.
Free or paid
For most sites a free Let's Encrypt certificate is enough. It is issued automatically, renews every 90 days, and encrypts exactly as strongly as a paid one — the cryptography is identical.
Paid certificates with extended validation also verify the legal entity behind the domain. That matters for banks and financial services; a typical service site or shop gains nothing from paying.
Why 'not secure' persists with a valid certificate
The usual cause is mixed content: the page is served over https while images, fonts or scripts on it are linked over http, so the browser drops the security indicator.
The other cause is an expired certificate. Auto-renewal often breaks after a migration or DNS change, and you find out from a customer. Add an expiry alert in any monitoring service.