No single US law requires every business website to run SSL, but in practice HTTPS has become the baseline anyway, driven by browser warnings, Google’s ranking signal, and payment card rules rather than one central statute. The clearest legal trigger is PCI DSS: any site that processes credit card payments directly must encrypt that traffic. For a typical contractor or home services site with a contact form and no in-house checkout, the pressure comes less from a specific law and more from what happens when a visitor sees a security warning before they’ve even read the homepage.
Why there’s no single federal rule, and what fills the gap
The US has no GDPR-style law that names encryption as a blanket requirement. Instead, coverage comes from several overlapping sources. The Federal Trade Commission has used its authority over unfair and deceptive practices to penalize companies that stored or transmitted sensitive customer data without basic safeguards like encryption, treating weak security itself as an unfair practice in several enforcement actions. A growing list of state laws, including data breach notification statutes and comprehensive privacy laws like California’s CCPA/CPRA, require “reasonable security measures” for personal data without spelling out HTTPS by name. And PCI DSS, the payment card industry’s own standard, explicitly requires encrypted transmission of cardholder data across open public networks, which covers any site handling card numbers directly rather than through a hosted checkout page.
For a plumbing, HVAC or electrical contractor site that collects only a name, phone number and job description through a contact form, none of these frameworks name HTTPS as a hard requirement. The practical case for it comes from somewhere else entirely: what a browser shows a visitor, and what a payment processor requires the moment online payments enter the picture.
The moment a home services business adds online deposits or invoice payments directly on its own site rather than through a hosted third-party page, PCI DSS stops being theoretical. A roofing company that starts collecting card numbers through its own quote form, instead of routing customers to a processor’s hosted checkout, takes on the encryption and compliance burden itself. Most small businesses avoid that entirely by using a hosted payment link or a processor’s own checkout page, which keeps the card data off their own server and shifts the PCI DSS obligation to the processor.
What Chrome shows without HTTPS
Since Chrome 68 launched in July 2018, Google Chrome marks any page served without HTTPS as “Not Secure” directly in the address bar. Firefox, Edge and Safari followed with similar warnings. Pages with input fields, like a quote request form, typically get a more prominent version of the warning. For a home services business, that means a homeowner who lands on the site from a Google search and sees a red “Not Secure” label often just hits back and calls the next contractor on the list instead. That lost lead never shows up in any report, it just quietly doesn’t happen.
The Google ranking effect
Google confirmed HTTPS as an official ranking signal back in 2014, and has been explicit ever since that the effect is minor, weighing far less than content quality or page speed. A business already working on why page speed affects how many customers convert should treat HTTPS as one of several baseline requirements to knock out together, not as an SEO tactic on its own. At this point HTTPS works more like a ticket to the game than a competitive edge: nearly every legitimate business site already has it, so not having it stands out negatively far more than having it moves rankings up.
SSL versus TLS: the short version
The two terms get used interchangeably, but technically TLS (Transport Layer Security) is the successor to the original SSL protocol and has been the only one actually in use for years. When a hosting provider or agency talks about an “SSL certificate” today, they almost always mean a TLS certificate, the old name just stuck out of habit. For a home services business this distinction has no practical weight, what matters is that a current TLS version is running rather than an outdated, weaker one. A decent hosting provider handles that automatically in the background without anyone on the business side needing to track protocol versions.
Subdomains and wildcard certificates
A business running a separate subdomain, say a customer portal at portal.examplecontractor.com or a booking tool on a subdomain, generally needs its own certificate or a wildcard certificate that covers every subdomain at once. For most single-domain contractor sites with maybe a www variant, this question never really comes up, since modern free certificates like Let’s Encrypt cover both variants by default. It becomes relevant once a business adds a separate functional area, like a job applicant portal or a customer login, on its own subdomain, at which point it’s worth a quick look at the certificate settings with the hosting provider.
What an SSL certificate actually costs
| Certificate type | Typical cost | Who actually needs it |
|---|---|---|
| Let’s Encrypt (DV) | Free, auto-renewing | Almost every contractor or home services site |
| Paid DV certificate from a vendor | Roughly $10 to $80 per year | Rarely necessary once Let’s Encrypt is available |
| OV certificate (Organization Validation) | Roughly $60 to $250 per year | Larger e-commerce sites wanting visible business verification |
| EV certificate (Extended Validation) | Roughly $100 to several hundred dollars per year | Banks, payment processors, rarely relevant for a home services business |
For the overwhelming majority of home services websites, a free Let’s Encrypt certificate is genuinely enough. It provides the same encryption strength as a paid certificate, the only difference is the depth of business verification behind it, which adds little practical value for a standard company site that doesn’t process payments directly. Most hosting providers now install Let’s Encrypt automatically and renew it every 90 days without anyone having to remember.
Checking your own site in under a minute
- Open the business website in a browser and look for the padlock icon next to the address.
- If the padlock is missing or the browser shows “Not Secure,” the certificate is either missing or expired.
- Ask the hosting provider or whoever manages the site whether HTTPS is active and set to renew automatically.
- Check that internal links and embedded images also load over https://, since mixed content can trigger its own warning in some browsers.
- After switching hosting providers, verify the certificate again, since it doesn’t always carry over automatically during a migration.
An expired or misconfigured certificate is one of those things that gets missed easily during normal operations, precisely because it sits quietly in the background for months between renewals. What Happens Without Website Maintenance covers how an expired certificate, alongside missing backups, is one of the most common causes of a sudden drop in visitor trust or visibility.
For a home services business, SSL is less an open legal question than a solved baseline: set it up correctly once and it should run automatically without ever coming up again. Keeping that check in place as part of ongoing site upkeep is a standard part of our monthly service plan.