A handful of ideas about SSL persist well past their expiration date. Worth clearing up directly.
"Free certificates are less secure"
Not true — the encryption strength of a free domain-validated certificate and a paid one is identical. Price reflects validation depth and warranty, not cryptographic strength.
"I don't need HTTPS if my site doesn't take payments"
Modern browsers mark all plain HTTP pages as "Not Secure," including a contact form, login page, or a simple blog. Beyond the trust signal, it also prevents any form submission on your site from being trivially intercepted.
"SSL makes my site meaningfully slower"
True in the early 2000s, largely false today — modern hardware, TLS 1.3's shorter handshake, and the HTTP/2 support that comes bundled with HTTPS mean the net effect is close to neutral for most sites.
"The padlock means the site is safe"
It means the connection is encrypted and the certificate matches the domain — nothing about the site's actual content or intent. Phishing sites routinely have valid certificates for their own look-alike domains.
"Once I install a certificate, I'm done forever"
Certificates expire — 90 days to about 13 months depending on type — and need renewal, ideally automated, on an ongoing basis.
Why these myths persist despite being straightforward to disprove
Most of these misconceptions trace back to how SSL was genuinely different in the early 2000s, expensive, slow, and rare — the beliefs simply haven't caught up to how completely the landscape has changed since free, fast, automated HTTPS became the default rather than the exception.
The one myth that's actually still partly true, with an important caveat
The claim that HTTPS makes a site slower was genuinely accurate in the early 2000s given the computing power of the era, and remains marginally true in a literal sense, the handshake does add some latency, but the practical, measurable effect today is close to negligible on modern hardware, especially once TLS 1.3's faster handshake and HTTP/2's performance benefits are factored in.
Why 'I already have a free certificate so I'm fully secure' is its own separate myth
Having a valid, correctly installed certificate secures the connection and confirms domain identity, but says nothing about whether your server software is patched, your CMS plugins are current, or your application code has vulnerabilities — HTTPS is one necessary layer among several, not a complete security posture on its own.
Why a bigger or more prominent padlock icon was never actually a real signal
Some browser extensions and third-party tools have historically claimed to make the padlock more prominent or add additional trust badges — none of these actually change the underlying certificate validation or security in any way, they're purely cosmetic additions layered on top of the same standard browser trust check.
The myth that certificate price directly correlates with encryption strength
A certificate's price reflects validation depth, CA warranty, and support, never the strength of the underlying cryptography itself — a free DV certificate and an expensive EV certificate from the same era use identical key lengths and cipher suite support, assuming both were issued using current CA defaults.
Why revisiting old assumptions periodically is worth the effort
SSL and HTTPS practices have changed dramatically over two decades, and beliefs formed even five or ten years ago can already be outdated — it's worth periodically revisiting what you assume you know about this topic against current guidance rather than relying on understanding formed once and never updated.
What role outdated tutorials and search results play in perpetuating these myths
A significant driver of these persistent myths is simply that older tutorials, forum posts, and search results from the pre-2015 era remain indexed and findable online, continuing to circulate outdated information long after the underlying technical landscape actually changed.
A closing thought
A quick closing thought: given how much genuinely changed over the past two decades, it's worth periodically re-examining even your own confident assumptions about this topic against current guidance.