You've seen the padlock icon next to a website address and probably know, vaguely, that its absence is bad. Here's what's actually happening behind it, and why letting a certificate lapse is a bigger deal than it looks.
SSL (and its modern successor, TLS — people still say "SSL" out of habit) encrypts the connection between a visitor's browser and your server. Without it, anything submitted on your site — login credentials, contact form details, payment information — travels in plain text. Anyone positioned between the visitor and your server (a compromised public wifi network, a malicious browser extension, an ISP) can read it directly.
An SSL certificate is what makes that encryption possible, and it also verifies that the site a visitor's browser connected to is actually the one it claims to be — protecting against a category of attack where a fake server impersonates your domain.
A scan checking SSL/TLS isn't just confirming a certificate exists — it's checking that the certificate is currently valid (not expired), correctly matches your domain, isn't using outdated/weak encryption protocols, and is set up so that the unencrypted (http://) version of your site properly redirects to the encrypted one rather than being served in parallel.
If you don't have SSL at all: most modern hosting providers (Netlify, Vercel, Cloudflare, and most managed WordPress hosts) issue and renew certificates automatically at no cost via Let's Encrypt — there's often no action needed beyond checking a setting is enabled. If you manage your own server, certbot is the standard free tool for issuing and auto-renewing certificates.
If you have SSL but aren't sure it's configured correctly — valid, auto-renewing, properly redirecting — that's exactly what an automated scan checks for you, rather than requiring you to manually inspect certificate details.
RapidVuln checks certificate validity, expiration, and HTTPS redirect configuration as part of every free scan.
Run Your Free Scan →