SSL, TLS, HTTPS and HSTS are often treated as interchangeable, but they describe different things. A certificate helps confirm a website’s identity, TLS secures the connection, HTTPS is HTTP carried over that connection and HSTS tells a browser to use HTTPS exclusively for a domain. Together they protect credentials, forms, cookies and other data in transit.
Why do people still say “SSL certificate”?
SSL is the historical predecessor of TLS and is technically obsolete. The familiar term SSL certificate remains common. Modern servers should use current TLS versions and strong ciphers. A certificate contains the domain name and a digital signature from a trusted certificate authority. It does not prove that a business behaves honestly; it proves that the connection belongs to the stated domain.
What TLS actually protects
During the TLS handshake, browser and server agree security parameters and the certificate is validated. Traffic is then encrypted and tampering in transit becomes detectable. This protects against eavesdropping on networks such as public Wi-Fi. TLS does not repair a compromised website, weak password or malicious plugin; application security remains essential.
Deploy HTTPS consistently
Install a certificate for every hostname in use, redirect every HTTP URL once to its equivalent HTTPS URL and update internal links. Remove mixed content: one image, script or iframe loaded over HTTP can cause warnings and blocked features. Check sitemaps, canonicals, webhooks, API integrations and email templates too.
Automatic renewal still needs monitoring
A certificate expires. Automatic renewal is only reliable when installation and the service reload also succeed. Monitor expiry externally, verify the complete certificate chain and retest after changes. CAA DNS records can restrict which certificate authorities may issue certificates for the domain.
HSTS is powerful, so deploy it gradually
The Strict-Transport-Security header makes browsers remember HTTPS and prevents visitors from bypassing TLS errors. Begin with a short max-age after every route works over HTTPS. Increase it only after clean testing. Add includeSubDomains only when every subdomain genuinely supports HTTPS. Preloading has long-lived consequences and should not be the first experiment.
Implementation checklist
- A valid certificate for the main domain, www and required subdomains.
- TLS 1.2 and 1.3 where supported; obsolete protocols disabled.
- One clean HTTP-to-HTTPS redirect without a chain.
- No mixed content in pages, forms or embeds.
- Secure, HttpOnly and appropriate SameSite cookie attributes.
- Automatic renewal plus external expiry monitoring.
- A gradual HSTS rollout and a complete subdomain inventory.
HTTPS is a baseline requirement rather than a premium feature. Combine it with updates, malware protection, strong authentication and backups. Read our WordPress security guide or explore hosting with free SSL.
