An SSL certificate (or TLS, its more modern version, though everyone still calls it SSL out of habit) is what lets your site load under HTTPS instead of HTTP, and in practice it shows up as that padlock next to the address in the browser. Its technical job is to encrypt the connection between the visitor's browser and your server, so nobody can intercept that information along the way.
For years this was thought to matter only for sites handling payments or very sensitive data. That's no longer the case: any site without HTTPS, including a purely informational landing page with no forms, now gets a visible "not secure" warning in Chrome and in most modern browsers, right in the address bar, where any visitor sees it before reading a single word of your content.
The impact beyond security
Google confirmed years ago that HTTPS is a ranking signal, though a relatively minor one compared to other factors. The real, measurable impact tends to be indirect: a "not secure" browser warning generates immediate distrust, and that distrust translates into people leaving the page, which does affect behavioural metrics Google factors in more directly.
How to know if your site already has it properly set up
It's not enough for the homepage to load over HTTPS: you need to check every internal page does too, that no resources (images, scripts) are still loading over HTTP inside an HTTPS page (which triggers the "mixed content" warning), and that there's an automatic redirect from the HTTP version to the HTTPS one, so nobody lands on the insecure version by mistake through an old link.
Does HTTPS cost money?
Today, in most cases, no: most hosting providers include free certificates (like those from Let's Encrypt) that renew automatically with no manual intervention. Paid certificates still exist and offer some extended validation or extra guarantee, but for the vast majority of websites, including small and medium online stores, the free certificate is more than enough.
Frequently asked questions
Does my site need HTTPS even without forms or a store?
Yes. Any modern browser flags sites without HTTPS as "not secure", regardless of their content, and that affects visitor trust from the very first second.
What happens if I migrate from HTTP to HTTPS on an already-ranked site?
Technically it's a URL change (from http:// to https://), so it needs to be done with properly configured 301 redirects to avoid losing your accumulated rankings. Done correctly, the impact is minimal or even positive over the medium term.
Is the free certificate as secure as a paid one?
In terms of encryption, yes: the underlying technology is the same. Paid certificates add layers of business identity validation (useful mainly for banks or large brands), but the encryption level protecting the connection is equivalent.