- Getting Started
SSL Certificates and HTTPS: What They Are, Why They Matter, and How Webflow Handles Them
Key takeaways
- SSL encrypts the connection between a visitor's browser and your server, switching your site to HTTPS: essential for any organisation asking for donations or collecting personal data.
- HTTPS is not optional: HTTP sites trigger browser "Not Secure" warnings, miss a confirmed (if lightweight) Google ranking signal, leave form data without the encryption UK GDPR Article 32 names as a security measure, and cannot process card payments.
- Webflow provisions and renews a free SSL certificate automatically through Let's Encrypt and Google Trust Services, covering both the root domain and the www subdomain with no manual installation.
- The certificate is issued only after DNS points to Webflow, and DNS changes can take up to 48 hours to propagate before it is fully active.
- Even with SSL active, "mixed content" (resources loaded over HTTP, often from migrated images or third-party embeds) can still trigger warnings, so check the browser console and update those URLs to HTTPS.
- Additional subdomains beyond root and www need their own SSL coverage, typically handled by whichever service they point to.
Summary
What SSL certificates are, why HTTPS matters for donor trust, GDPR compliance and SEO, and why Webflow's automatic SSL provisioning is one of the strongest arguments for the platform.
What SSL Is and Why Your Nonprofit Website Needs It
SSL (Secure Sockets Layer), now technically TLS (Transport Layer Security), encrypts the connection between a visitor's browser and your website's server. When SSL is active, your site loads over HTTPS instead of HTTP, and the browser shows a padlock icon.
For nonprofit websites, SSL isn't optional:
- Browser warnings: Chrome has marked every HTTP page "Not Secure" in the address bar since July 2018, and Safari can be set to warn before connecting over HTTP. For an organisation asking for donations or collecting personal data, that warning undermines trust immediately.
- Google ranking signal: Google confirmed HTTPS as a ranking signal in 2014, describing it as "a very lightweight signal" affecting fewer than 1% of global queries.
- Data protection: If your site has forms (contact, donation, newsletter sign-up), SSL encrypts the data in transit. UK GDPR Article 32 names encryption of personal data as an appropriate security measure.
- Donation platform requirement: Stripe requires payment pages to run on TLS 1.2 or above. A donation page on an HTTP site won't process payments.
How SSL Works on Webflow
Webflow handles SSL automatically for sites hosted on Webflow. When you connect a custom domain, Webflow provisions a free SSL certificate through Let's Encrypt and Google Trust Services and manages renewal automatically.
This means:
- No need to purchase an SSL certificate separately
- No manual installation or configuration required
- Renewal happens automatically for as long as your DNS stays pointed at Webflow, so there is no annual renewal process to manage
- Both the root domain (socialectric.com) and www subdomain (www.socialectric.com) are covered
The SSL certificate is provisioned after DNS records are correctly pointed to Webflow. DNS changes can take up to 48 hours to propagate in all locations, although this usually happens within a few hours.
Verifying SSL Is Active
Browser Check
- Visit your site in Chrome
- Look at the address bar: there should be a padlock icon before the URL
- Click the padlock → "Connection is secure" → certificate details
- Confirm the certificate is valid and not expired
Webflow Dashboard Check
In Webflow: Site Settings → Hosting → look for the SSL status indicator next to your custom domain. It should show as active/connected.
Mixed Content Check
Even with SSL active, your site can still show security warnings if it loads resources (images, scripts, fonts) over HTTP instead of HTTPS. This is called "mixed content."
To check: open your site, press F12 to open developer tools, and look at the Console tab. Mixed content warnings will appear as yellow or red messages referencing HTTP resources.
Common causes of mixed content on nonprofit Webflow sites:
- Images uploaded with absolute HTTP URLs (usually from content migration)
- Embedded content from third parties loaded over HTTP
- Custom code referencing HTTP resources
Fix by updating every resource URL to HTTPS. Do not reach for a protocol-relative URL (//example.com/image.jpg): it resolves to whichever scheme the page itself was loaded over, so it inherits HTTPS rather than guarantees it, and it is no longer the recommended fix. Webflow's own guidance is to use URLs that begin with https:// everywhere you paste one: link settings, inline links in rich text, video fields, CMS link fields, Open Graph settings, and site-level or embedded custom code.
HTTPS Redirect
Your site should automatically redirect HTTP requests to HTTPS. On Webflow this is handled at the hosting level: SSL is enabled by default for sites created after 14 November 2018.
Verify by typing http://yourdomain.com in the browser. It should immediately redirect to https://yourdomain.com. If it doesn't, check your Webflow hosting settings.
For domain connection setup that enables SSL, see How to Connect Your Domain to Webflow via DNS.
What About Subdomains?
If your nonprofit uses subdomains (e.g., events.yourdomain.com or donate.yourdomain.com), each subdomain needs its own SSL coverage. Webflow's automatic SSL covers the root domain and www subdomain. Additional subdomains pointed to external services (donation platforms, event tools) are handled by those services' own SSL.
Common SSL Issues on Nonprofit Sites
"Your connection is not private" error after domain change: Usually means DNS hasn't fully propagated or the SSL certificate hasn't been provisioned yet. Wait up to 48 hours. If it persists, check DNS records in Webflow hosting settings.
Mixed content warnings despite HTTPS: Some element on the page is loading over HTTP. Check images, embeds, and custom code for HTTP references.
SSL certificate expired: Should not happen on Webflow (auto-renewal), but if you're on a different host, set a calendar reminder 30 days before expiry.
Further Reading
Two clicks. Three things.
Send the address of your website. Within two working days you get a short email naming the three things a funder would hold against it, including what AI assistants like ChatGPT and Google’s AI Overviews currently say about you. No report, no call, no follow-up unless you ask.
Received. Your three things arrive within two working days.
That did not send. Email hello@socialectric.com with your website address and I will reply from there.
Frequently asked questions
- Does our charity website really need an SSL certificate?
Yes. Chrome marks every page served over HTTP as 'Not Secure' in the address bar, which undermines trust immediately for an organisation asking for donations or collecting personal data. HTTPS is also a confirmed Google ranking signal, encryption of personal data is named as an appropriate security measure under UK GDPR Article 32 (see the GDPR compliance checklist for nonprofit websites), and card payment pages must run on TLS 1.2 or above, so a donation page on an HTTP site will not take payments.
- Do we have to buy or renew an SSL certificate on Webflow?
No. Webflow provisions a free certificate through Let's Encrypt and Google Trust Services when you connect a custom domain and manages renewal automatically, so there is nothing to purchase, install or diarise, and both the root domain and the www subdomain are covered. The certificate is issued after your DNS records are correctly pointed at Webflow, and DNS changes can take up to 48 hours to propagate in all locations.
- How do we check that HTTPS is actually working?
Visit the site in Chrome and look for the padlock icon before the URL, then click it, check it says the connection is secure, and open the certificate details to confirm it is valid and not expired. In Webflow, go to Site Settings, then Hosting, and look for the SSL status indicator next to your custom domain, which should show as active. Also type your address with http:// at the front: it should redirect straight to the https:// version.
- Why does our site still show a security warning when SSL is on?
Almost always mixed content: the page is loading images, scripts or fonts over HTTP even though the page itself is served over HTTPS. Press F12, open the Console tab and look for yellow or red messages referencing HTTP resources. The usual causes are images uploaded with absolute HTTP URLs during a content migration, third-party embeds loading over HTTP, and custom code referencing HTTP resources. Fix it by updating those URLs to HTTPS.
- Are our subdomains covered by the same certificate?
Webflow's automatic SSL covers the root domain and the www subdomain. Any additional subdomain, such as one for events or donations, that points at an external service is covered by that service's own SSL rather than Webflow's.
- We changed domain and now get 'Your connection is not private'. What is wrong?
Usually DNS has not fully propagated yet, or the certificate has not been provisioned. DNS changes can take up to 48 hours. If the error persists after that, check your DNS records in the Webflow hosting settings against the domain connection steps.