SSL/HTTPS is a security layer that encrypts every piece of data exchanged between a browser and a web server; it shows up as the padlock icon in the address bar. A site without a certificate opens with a "Not secure" warning in the browser, visitors leave before filling out a form, and the site falls behind competitors in Google search. That's why, in 2026, SSL isn't a line item you can negotiate away on a website project - it's a baseline requirement from day one.
In this article we cover the security topics we discuss with clients at the proposal stage - SSL, backups, updates, password policy - and what actually happens when a site gets hacked, and what it costs to recover. The goal is to lay out clearly which questions you should be asking when you're building or redesigning a site.
What is SSL/HTTPS, and why shouldn't it be negotiable?
SSL (Secure Sockets Layer) and its modern successor TLS encrypt information a visitor enters on your site - a contact form, payment details, a login password - so a third party can't read it in transit. HTTPS is the browser-visible form of that encryption - the padlock icon in the address bar. Today, every major browser - Chrome, Safari, Firefox - openly warns about sites without SSL; on some forms, users hit an extra confirmation screen before they can even continue.
As an agency, we'd urge caution around any firm that presents an SSL certificate as a separate, extra-cost line item in a proposal. A free Let's Encrypt certificate is standard on most hosting plans and takes only minutes to set up; charging extra for it usually points to either outdated infrastructure or opportunistic pricing.
There are three types of SSL certificates on the market: domain-validated (DV), organization-validated (OV), and extended-validation (EV). A free DV certificate is more than sufficient for a corporate brochure site or a clinic website - the encryption strength is identical. OV and EV certificates are typically reserved for banking or large-scale payment systems and can cost a few hundred dollars a year. An agency telling a small business "you need an EV certificate for security" and charging extra for it is, more often than not, an unnecessary cost.
A "Not secure" warning drives customers away
A "Not secure" warning is one of the strongest signals that makes a visitor leave a site immediately. On pages with a contact form, a booking step, or a checkout in particular, most users who see this warning close the tab before completing the action. One manufacturer's quote form went unfilled for three months because it wasn't served over SSL, and once the issue was spotted, there was no way to know how many potential customers had been lost along the way - because this kind of leak doesn't even show up in analytics data.
Picture a small neighborhood cafe: if its menu and reservation page are served without SSL, a customer browsing on their phone sees the warning, bounces back to Google, and clicks the next result instead. That's a single technical gap translating directly into lost revenue. The loss is even bigger for businesses with a high share of mobile visitors, since mobile browsers tend to surface the warning more prominently than desktop ones.
HTTPS's effect on Google rankings
Google has openly stated since 2014 that it uses HTTPS as a ranking signal; between two otherwise equal sites, the one on HTTPS gets a slight edge. On its own, this isn't a decisive factor, but a site without SSL definitely starts out at a disadvantage in search results. Modern browser behavior - the warning screen, higher bounce rates, shorter session times - also indirectly generates signals that work against rankings. We cover this in more depth from a technical SEO angle in our technical SEO checklist article, where SSL is one of the audit items.
Regular backups: don't hit the road without this insurance
Regular backups are the one safeguard that keeps the damage from any incident down to a matter of hours. A site with daily automated backups can be restored to a working state within a few hours after a hack or a server failure, while a site without a backup has only one option - a full rebuild from scratch, which usually takes days and never fully recovers all the content.
The question to ask when you get a proposal is straightforward: how often are backups taken, how many days of history are retained, and how long does restoring from a backup actually take? "We do backups" isn't a good enough answer - the frequency and storage location need to be spelled out concretely. Best practice is storing backups in a location separate from the site's own server, because if the server itself is fully compromised, a backup stored in the same place can fall into the attacker's hands too. Keeping at least seven days of history, ideally thirty, means that even if it takes a while to notice a problem, you can still roll back to a clean point.
Why software and plugin updates shouldn't be neglected
On CMS-based sites like WordPress, the large majority of security vulnerabilities come from an out-of-date core or plugins. Once a fix for a plugin vulnerability is published, malicious bots start scanning for it within weeks; every site that delays the update ends up on that scan list. When we come across a corporate site running more than thirty plugins, the first thing we do is figure out which ones are actually in use and which have simply been forgotten and left unupdated - because every unused plugin is an open door with ongoing risk and zero benefit.
When agreeing terms with an agency or hosting provider, get clear on exactly who handles updates and how often, so you don't end up discovering later that "nobody was touching it." When weighing the WordPress vs. custom software question, update burden should be one of your deciding factors; custom software manages its attack surface differently, but the need for maintenance never goes away.
Strong passwords and two-factor authentication (2FA)
Using a weak or shared password for the admin panel is the equivalent of leaving your site's door ajar. Automated attack bots try the most common password patterns thousands of times within minutes; predictable combinations like "123456", the company name, or a birth year are among the first things tried. With two-factor authentication (2FA) turned on, even a compromised password isn't enough to log in without phone confirmation - this single setting alone eliminates most of the hacking risk on its own.
Another common mistake at small businesses is having multiple employees share the same admin account. Giving each user their own login makes it possible to track who made a change and when, and lets you cut off a departing employee's access by deleting their own account rather than shutting down a shared one. A password manager makes it easy to generate a different, strong password for every account.
What actually happens if your site gets hacked?
When a site is compromised, the first sign is usually not the site crashing - quite the opposite, the site keeps looking normal while the real damage builds up in the background.
Spam content injection
The most common technique attackers use is adding hidden pages or links to your site: content promoting pharmaceuticals, gambling sites, or fake product pages gets embedded into your homepage's source code. The owner can go weeks without noticing, because this content is hidden from regular visitors and shown only to search engine bots.
Falling out of Google and getting blacklisted
Once Google detects this kind of spam content, it can remove the site from search results entirely or flag it in the browser with a "This site may harm your computer" warning. Normal traffic to a blacklisted site drops to nearly zero - even a search for the brand name itself surfaces the warning screen. A manufacturer's corporate site went through exactly this scenario, appearing in Google search flagged as "potentially unsafe" for two weeks, during which every incoming quote request simply stopped.
The risk is even bigger for e-commerce sites: an attacker who gets in through an old, unpatched plugin can target customer information or the payment flow in the checkout form. In that case, it's not just Google rankings that take a hit - customer trust in the business suffers too, and depending on jurisdiction, a data breach can trigger a legal notification obligation under privacy law (such as GDPR or, in Türkiye, KVKK).
How much does recovery actually cost?
Cleaning up a hacked site with a recent backup on hand is usually resolved with an intervention in the low hundreds of dollars and a few hours of downtime. Without a backup, on a site that hasn't been updated for months, the situation is different: the code has to be reviewed line by line, injected malicious code cleaned out, and a delisting request submitted to Google - a process that can run well over a thousand dollars and stretch across two to three weeks. The cost typically breaks down into:
- Code review and removal of malicious content
- Server and database security scanning
- Submitting the Google blacklist removal request and waiting out the review period
- Retroactively setting up missing safeguards like SSL, password policy, and 2FA
And none of that figure accounts for the appointments, orders, or form submissions lost during the downtime. Setting a site up correctly from the start - SSL, backups, updates - typically costs a small fraction of what this recovery process runs.
What to check after SSL is installed
Installing an SSL certificate isn't the end of the job; a common mistake is leaving a site reachable at both the http and https address. In that case, search engines see the same content at two different addresses and ranking strength gets split between them; the fix is to automatically redirect every request to the http address over to https. Another frequent issue is a "mixed content" warning: even if a page loads over https, if an image or script on it is still pulled from an http address, the browser removes the padlock icon or shows a partial warning. Checking for both of these at handover is the most practical way to confirm the SSL setup is actually complete.
Certificate expiry shouldn't be overlooked either; free certificates typically renew automatically every ninety days, but if that renewal automation breaks, a site can suddenly show an "expired certificate" warning out of nowhere. Confirming with your hosting provider that this renewal happens automatically prevents an unnecessary outage that might otherwise hit once a year.
Security questions to ask an agency before building a site
Asking these questions at the proposal stage eliminates most surprises down the road:
- Is the SSL certificate included in the package, or billed separately?
- How often are backups taken, how many days of history are kept, and how long does restoring take?
- Who handles CMS and plugin updates, and how often?
- Is 2FA supported for the admin panel, and is access managed per user?
- If the site gets hacked, what's the response process, and what's the estimated time and cost?
A proposal that can't answer these questions clearly and concretely probably means security wasn't part of the plan. We've gathered the other topics worth asking before commissioning a site in our questions to ask your web agency article, and you can check our how to choose a web design agency guide for the broader selection process.
At Welda, every web design and development project comes with SSL, regular backups, and up-to-date security infrastructure as standard - these aren't add-ons tacked on later, they're the starting point of the project. If you'd like to assess your site's security posture together, request a free initial consultation on our contact page.