Why does my site need HTTPS?
HTTPS encrypts the connection between your visitor and your site, and proves the site is really yours. It is no longer a nice-to-have: browsers actively warn people away from pages without it, and answer engines quietly skip them.
What it actually is
Think of the difference between handing someone a sealed envelope and shouting across a crowded room. Without HTTPS, everything between your visitor and your server travels in the open, and anyone in between can read it or change it on the way. The certificate is the other half: it is a third party vouching that the site answering is genuinely the one your visitor asked for, rather than something wearing its name.
Why it matters
This is the one signal where failure is visible to your customers before it is visible to you. A browser puts a warning between them and your homepage, and most people never get past it. Machines are quieter but no kinder: an answer engine deciding which sources to trust has no reason to reach for one flagged as insecure when a competitor is not. The cost is not a ranking penalty so much as being quietly left out.
What good looks like
Every page on the site loads over HTTPS with a certificate that is valid, unexpired and issued for the exact hostname people actually visit. No page, image, script or font on the site loads over the insecure version. The padlock is present everywhere, not just on the checkout.
Being honest about it
There is no honest argument against this one and no site it does not apply to, which is rare on this list. Certificates are free and renew automatically almost everywhere, so the failures we see are almost never a decision — they are a lapse. That is also why we treat it as a baseline rather than an achievement: having it earns you nothing, and lacking it costs you a great deal.
Where most sites go wrong
By far the most common failure is an expired certificate on a site that was set up correctly years ago and then left alone — automatic renewal broke, nobody was told, and the site is fine right up until the morning it is not. The second is a certificate valid for one hostname but not the one people use, so the bare domain warns while the www version is healthy. Both are invisible from inside a logged-in browser that has cached the old state.