Does a small business website need HTTPS?
Yes. HTTPS is the secure version of a web address: it keeps what passes between a visitor's browser and your site private and harder to tamper with. It matters most where visitors type in their details, such as a contact form. Google's Chrome Help says that on a site without a private connection, someone may be able to view and change what visitors send, and Chrome can label such sites "Not secure".
What HTTPS is, in plain words
A secure web address starts with https rather than http. Chrome Help explains that Chrome secures HTTPS connections with website certificates, and that these certificates "encrypt the link between a site and your browser".
Google's web.dev article "Why HTTPS matters" says HTTPS helps prevent intruders from tampering with communication between a site and its users' browsers, and prevents them from passively listening in. Its advice is plain: "Always protect all your websites with HTTPS", even sites that do not handle sensitive information.
Why it matters for forms
Chrome Help says that when a site does not use a private connection, someone may be able to view and change the information a visitor sends and gets through that site. For pages it marks as not secure or dangerous, its advice to visitors is "Do not enter any personal information on this page".
A contact form asks people to do exactly that. If the page holding your form is not secure, careful visitors may simply leave, and the details of those who do fill it in are less protected.
Why it matters for trust
Chrome Help says that to resolve the issue, "the site owner must secure the site and your data with HTTPS". It also describes an optional setting, Always use secure connections, which shows a "Your connection to this site is not secure" warning when a site does not support HTTPS. A visitor who sees a warning before your page even appears may never read it.
HTTPS is a baseline, not proof that a business is genuine. Chrome Help reminds people to be careful with personal information even on secure sites and to check the site name in the address bar.
A quick check any owner can run
- Open your site on a phone and a computer and look at the symbol to the left of the address. Many browsers show a padlock or a similar icon there; in Chrome, a "Not secure" label is the warning sign.
- Type your address starting with http:// and see whether it switches to https:// on its own.
- Check the contact page and any booking or quote form, not just the home page.
- If you see a full-page "Your connection is not private" error, Chrome Help says there is a problem with the site, the network or the device. If it persists on another network, ask whoever runs your hosting.
- Recheck after renewing hosting or moving the site, since a move or renewal can be a time when the secure connection breaks.
Sources
- Google Chrome Help, "Check if a site's connection is secure"
- web.dev (Google), Kayce Basques, "Why HTTPS matters" (last updated November 23, 2015)
Related answers
- What does looking after a small business website involve?
- Does a small business website need a privacy policy?
- How do you make a website trustworthy to a new visitor?
Websites, upgraded or built
Most businesses do not need a new website. They need the one they have to load fast, say clearly what they do and ask the visitor to take one step.