SSL/TLS Basics Every Site Owner Should Know

· 6 min read
Hand holding a brass padlock

Every modern website needs HTTPS, but the terminology around it confuses a lot of site owners. Here is a plain-English breakdown.

SSL vs TLS — what is the difference?

SSL (Secure Sockets Layer) is the original protocol, introduced in the 1990s. It has been deprecated since 2015 due to known vulnerabilities. TLS (Transport Layer Security) is its successor — TLS 1.2 and TLS 1.3 are what actually encrypt your traffic today.

The padlock you see in the browser address bar represents a valid TLS certificate, not SSL. The industry still calls it “SSL” colloquially, but the underlying protocol is TLS.

What does a certificate actually do?

A TLS certificate does two things:

  1. Encryption — scrambles data in transit so an attacker intercepting the connection cannot read it.
  2. Authentication — proves the server you connected to is actually the server it claims to be (via a trusted Certificate Authority signature).

Without HTTPS, passwords, form submissions, and session cookies travel as plain text.

What a certificate does not do

This gets oversold, so it is worth stating clearly.

A certificate does not mean a site is safe, trustworthy, or free of malware. It means the connection is encrypted and the domain name was verified. A phishing site can have a perfectly valid certificate — and most do, because they are free.

It also does nothing for security at rest. Your database, your backups and your file permissions are unaffected by HTTPS. Those are separate problems with separate solutions.

Let’s Encrypt and automatic renewal

HOSTEMCLOUD provisions Let’s Encrypt certificates automatically for every domain pointed to your account. Let’s Encrypt certificates are valid for 90 days. The server renews them at day 60, so you should never see an expiry warning.

If you bring your own certificate (DV, OV, or EV), you can install it via the cPanel SSL/TLS manager. Renewal reminders are sent to your account email 30 days before expiry.

Expired certificates are one of the most common avoidable outages on the web, and they almost always happen on a manually installed certificate that someone forgot. Automatic renewal is worth more than any paid certificate’s warranty.

TLS 1.3 — why it matters

All HOSTEMCLOUD servers negotiate TLS 1.3 when the client supports it. TLS 1.3 cuts the handshake from two round-trips (TLS 1.2) to one, which reduces connection setup time by roughly 100ms on typical latency. It also removes cipher suites that have known weaknesses, so older attack vectors (POODLE, BEAST) do not apply.

That handshake saving compounds on every new connection, which makes it a genuine performance feature and not only a security one — see what “high-performance hosting” actually means.

Mixed content: the failure people miss

A page served over HTTPS that loads one image, script or stylesheet over http:// is mixed content. The browser either blocks the resource or downgrades the padlock, and on a checkout page that happens at the precise moment a customer is entering card details.

It usually creeps in through hardcoded URLs in the database after a migration, or a theme option pointing at an old domain. Find it by opening the browser console on the affected page — mixed content is always reported there.

For stores this matters enough to be a pre-launch checklist item; more on that in hosting for WooCommerce stores in Costa Rica.

Certificates during a migration

Moving hosts introduces a specific gap: if the certificate is not installed on the new server before DNS points at it, the first visitors after the cutover get a browser security warning.

The fix is to issue the certificate in advance — either through DNS validation or at the host level — and verify HTTPS works before the switch. The full sequence is in zero-downtime WordPress migration.

Quick checklist

  • HTTPS is forced (HTTP redirects to HTTPS) — toggle in cPanel → Domains → Force HTTPS
  • Your certificate covers both yourdomain.com and www.yourdomain.com
  • No mixed-content warnings in the browser console
  • HSTS header is set (available via .htaccess or cPanel → Security headers)
  • Renewal is automatic, not a calendar reminder
  • Checkout and login pages verified specifically, not just the homepage

Verify the certificate and protocol from the command line:

curl -sI https://yourdomain.com | head -1
openssl s_client -connect yourdomain.com:443 -tls1_3 </dev/null 2>/dev/null | grep -i "protocol\|cipher"
← Back to blog