SSL and HTTPS certificate
· by the Agence Web Premium team, Guéliz Marrakech
Direct answer: an SSL certificate is free and sets up in just a few minutes. Without it, Chrome displays "Not Secure" next to your address and Google deranks you. There is no valid reason to do without it in 2026.
We still regularly see professional Moroccan sites in simple HTTP. It is the fastest and most cost-effective correction available.
Why is HTTPS essential?
In short: Because browsers display a warning without it, Google makes it a ranking criterion, and the forms circulate in the clear.
Three concrete consequences of the absence of HTTPS:
- Immediate loss of confidence. Chrome displays "Not Secure" in the address bar. One in two visitors give up.
- Ranking penalty. Google has confirmed this as a ranking signal for years.
- Real risk. The data entered in your forms – name, telephone number, message, password – circulates unencrypted on the network.
For an online store, the absence of HTTPS simply prevents the integration of a card payment.
How much does an SSL certificate cost?
In short: Nothing. Let's Encrypt delivers free certificates recognized by all browsers, automatically renewed.
Almost all serious hosts offer one-click activation from their interface. If yours charges for this service, that's a signal: change host.
Paid certificates exist for specific uses — extended validation displaying the company name, coverage of multiple subdomains, financial guarantees. For 99% of Moroccan sites, the free certificate is strictly equivalent in terms of security.
What configuration errors are common?
In short: Mixed content, missing redirect, and expired certificate. All three cancel the benefit of HTTPS.
- Mixed content. The page is in HTTPS but loads images or scripts in HTTP. The browser displays a warning. Correction: switch all resources to HTTPS.
- Missing redirect. The site responds in HTTP and HTTPS, creating two distinct versions in the eyes of Google – therefore duplicate content. Correction: systematically redirect to 301.
- Certificate expired. Auto-renewal failed and no one saw it. Visitors see a red alert screen. Fix: Monitor expiration date.
- Canonical in HTTP. Frequent technical detail that sends Google to the old version.
How to switch an existing site to HTTPS?
In short: Activate the certificate, redirect all HTTP to 301, fix internal links, then update Search Console.
- Activate the certificate with the host.
- Set up a 301 redirect of all HTTP addresses to HTTPS.
- Fix internal links, images and scripts still in HTTP.
- Update canonical tags and sitemap.
- Declare the HTTPS version in Search Console.
- Update the links in your tools: social networks, Google profile, email signatures.
The operation takes one to three hours on a standard site. A drop in traffic of a few days is normal, followed by a return to the previous level.
HTTP or HTTPS: what changes
| Criteria | HTTP | HTTPS |
|---|---|---|
| Browser view | “Not secure” | padlock |
| Google Ranking | penalized | advantage |
| Form data | in plain language | encrypted |
| Online payment | impossible | possible |
| Cost | 0 MAD | 0 MAD |
| Set up | — | 1 to 3 hours |
Frequently asked questions
Does an SSL certificate cost money?
No. Let's Encrypt issues free certificates recognized by all browsers. If your host charges for it, change hosts.
Why does Chrome show “Not Secure” on my site?
Because it is in HTTP, without an SSL certificate, or because it loads resources in HTTP from an HTTPS page.
Does HTTPS improve SEO?
Yes, Google has confirmed it as a ranking signal. And above all, it avoids the loss of visitors linked to the warning.
What is mixed content?
An HTTPS page that loads images or scripts over HTTP. The browser then displays a warning despite the certificate.
How long does it take to switch to HTTPS?
One to three hours on a standard site, including redirects and corrections.
Will I lose traffic by migrating?
A drop of a few days is normal, followed by a return to the previous level if the 301 redirects are correct.
Is a paid certificate required for a store?
No, the free certificate is technically equivalent. The paid versions mainly provide commercial guarantees.
Does the certificate renew itself?
Yes if configured correctly, every 90 days. You still have to monitor that the renewal works.
Does your site say “Not Secure”?
We check your certificate, your redirects and your mixed content. Free, within 24 hours.
