The padlock is free.
Identity costs money.

No. The encryption is identical — the same algorithms, the same key strengths, the same protection in transit. What a paid certificate adds is verification of who you are and a warranty from the issuer if that verification turns out to be wrong. Neither of those makes the connection more encrypted.

Three legitimate reasons: a client, insurer or procurement policy requires warranty cover; an organisation wants its verified legal name inside the certificate; or a regulated sector mandates extended validation. Outside those, the free certificate is genuinely the right answer and we will tell you so rather than sell you one.

On our plans the free certificate costs nothing and covers most sites completely. Paid certificates start at roughly nine dollars a year for domain validation and rise with the depth of the check the issuer performs. Every figure on this page is what we pay plus our margin, and it renews at the same price.

Yes. Browser trust has nothing to do with which country you are in — it depends on whether the issuing authority is in the browser's root store. Let's Encrypt, Sectigo, Comodo and DigiCert all are, so a visitor in Karachi sees exactly what a visitor in London sees.

Every certificate expires. The free one renews itself every ninety days automatically with nothing for you to do. Paid certificates run for a year or more, and we send reminders well before the date. A short lifespan is a security feature rather than a limitation — a compromised certificate stops being useful very quickly.

Browsers stop trusting the site and show a full-page warning that most visitors will not click past. Email over SSL can break at the same time. Nothing is lost permanently — installing a valid certificate clears it immediately — but the site is effectively offline until you do.

A standard certificate covers one domain and its www version. A wildcard covers every subdomain under a name, including ones you create later. On our hosting the free certificate is issued per subdomain automatically, so in practice most people never need to buy a wildcard at all.

With domain validated certificates, no — the padlock is identical whether it was free or cost two hundred dollars. With organisation and extended validation, a visitor who clicks into the certificate details can see your verified company name. Very few visitors ever do this.

Not meaningfully. Modern TLS on HTTP/2 and HTTP/3 is usually faster than an unencrypted connection, because those protocols require encryption and bring their own performance improvements with them. The handshake cost is measured in milliseconds and only happens once per connection.

Yes, and it is usually a ten-minute job. We issue and install the certificate, then update any hard-coded http:// links inside the site so nothing loads insecurely. There is no downtime and no charge on a HostElevate plan.

Yes, at no charge on any of our hosting plans. Send us the certificate files and we will install and configure it, including the intermediate chain that people frequently miss — a missing chain is the single most common reason a correctly purchased certificate still shows an error.

It pays out to a party who suffers a loss because the certificate authority mis-issued a certificate — for example, issuing one to somebody impersonating you. It is protection against the issuer failing, not against your site being hacked, and it is very rarely claimed. The issuing authority pays it, not us.

Yes. Browsers mark sites without it as not secure, search engines prefer secured sites, and any form at all — including a contact form — sends data that should not travel in plain text. This is precisely why we include it free rather than selling it.