If your website shows "Not Secure" in the browser address bar — and most older Kenyan business sites still do — you're losing customers before they even read your first sentence. The fix is free, takes about five minutes, and Hostiko applies it automatically to every site we host. This guide is the full picture: what SSL actually does, why Google ranks HTTPS sites higher, and exactly how to get the padlock.
What is SSL, and what does HTTPS mean?
SSL (Secure Sockets Layer — technically TLS now, but everyone still says SSL) is the encryption protocol that turns http:// into https://. With SSL in place, anything sent between your visitor's browser and your website — login passwords, contact form submissions, M-Pesa STK push triggers, card numbers — is encrypted end-to-end. Nobody between the two computers can read it.
Without SSL, your visitor's ISP, the Wi-Fi router at the coffee shop they're sitting in, and anyone running packet capture can read every byte your visitor sends you. Including their password.
Why does Kenya need to care?
Three concrete reasons.
1. Browsers shame you publicly.
Chrome, Firefox, Edge and Safari all display a prominent "Not Secure" badge in the address bar on any HTTP site, and a full-screen interstitial warning on form submissions. Imagine a customer about to enter their phone number into your contact form and Chrome interrupts with "Attackers may be trying to steal your information." That customer just bounced.
2. Google ranks HTTPS sites higher.
Google publicly confirmed in 2014 that HTTPS is a positive ranking signal. It's not the biggest factor, but every signal counts when you're competing with three other Kenyan businesses for the same Nairobi search term. Some Kenyan hosts charge KSh 5,000+ a year for SSL; we include it free on every plan. Don't lose ranking points to something that costs nothing.
3. M-Pesa and payment processors require it.
If you're integrating Daraja API (Safaricom M-Pesa), KopoKopo, PesaPal or any card-processing gateway, the callback URL you provide must be HTTPS. No SSL means no online payments. Period.
How much does an SSL certificate cost in Kenya?
Two paths:
- Free SSL via Let's Encrypt: KSh 0. Issued in under a minute. Renews automatically every 90 days. Same encryption strength (TLS 1.3, 2048-bit RSA or ECDSA) as a paid certificate. This is the right choice for 99% of Kenyan websites.
- Paid Extended Validation (EV) SSL: KSh 5,000–25,000/year. The browser displays your verified company name in the address bar. Used mainly by banks, large e-commerce platforms, and government sites where additional legal verification is required. Not necessary for typical SMEs.
For a normal Kenyan business, blog, school, NGO or freelance portfolio: Let's Encrypt is free and indistinguishable to a normal visitor. Same green padlock.
Step-by-step: getting SSL on your Hostiko website
For Hostiko-hosted sites, SSL is fully automatic. You literally don't have to do anything. Here's what happens:
- You point your domain at Hostiko (or buy a new domain with us).
- DNS propagates — usually under 15 minutes for .co.ke.
- Our DirectAdmin server detects the domain pointing at us and automatically requests a Let's Encrypt certificate via the AutoSSL system.
- The certificate is issued and installed within 5–10 minutes.
- Your site is now reachable at https://yourdomain.co.ke with the padlock.
- Every 60 days, the system automatically renews the certificate. You never see this happen.
If you're hosted elsewhere
The process depends on the panel:
- cPanel: Look for "SSL/TLS Status" or "AutoSSL." Click "Run AutoSSL."
- DirectAdmin: "SSL Certificates" → "Free & automatic certificate from Let's Encrypt."
- Plesk: "SSL/TLS Certificates" → "Install" → "Let's Encrypt."
- VPS / raw Linux: Install certbot via SSH, run
certbot --apacheorcertbot --nginx.
If your host charges for SSL or doesn't support Let's Encrypt, that's a sign to move. Modern hosting includes free SSL — it's not a premium feature anymore.
After SSL is installed: redirect HTTP to HTTPS
Just installing the certificate isn't enough. Old links to http://yourdomain.co.ke still resolve to the unencrypted version. You need to force-redirect all HTTP traffic to HTTPS. This is usually one line in your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]On Hostiko, this is also done automatically when you enable "Force HTTPS" in DirectAdmin (or it's already on by default).
Common SSL problems and how to fix them
"Your connection is not private" warning
Usually means the certificate is for the wrong domain, expired, or the visitor is seeing it during the brief window before issuance is complete. If it persists more than 30 minutes after setup, contact support.
"Mixed content" warnings
This happens when your HTML loads images, scripts, or stylesheets over http:// instead of https://. The fix: use protocol-relative URLs (//example.com/image.jpg) or full https:// URLs everywhere in your HTML. For WordPress, use the free "Really Simple SSL" plugin to auto-fix everything.
The site loads but the padlock has a yellow warning
Same as mixed content — at least one resource is loading over HTTP. View the browser console (F12 → Console tab) and it'll list the offending URLs.
Will SSL slow my website?
No — opposite, actually. Modern SSL via TLS 1.3 has measurable overhead in the single-digit milliseconds. Plus HTTPS is required for HTTP/2 and HTTP/3 in major browsers, both of which are significantly faster than HTTP/1.1. Switching from HTTP to HTTPS on a slow legacy site can actually make it faster.
FAQ
Do I need a separate SSL for each subdomain?
Yes, but Let's Encrypt issues a separate cert for each subdomain automatically. You can also use a wildcard cert (*.yourdomain.co.ke) that covers all subdomains at once — Hostiko supports both.
What about email SSL?
Email (SMTP/IMAP) uses the same certificate — when you set up Outlook or Gmail to fetch mail from mail.yourdomain.co.ke, the connection is encrypted with the same cert.
Do I need to back up my SSL cert?
No. Let's Encrypt auto-issues new ones every 60 days. There's nothing to back up that won't be regenerated automatically.
Can I use SSL with WordPress?
Yes — WordPress fully supports HTTPS. In Settings → General, update both "WordPress Address" and "Site Address" to start with https://. Most managed WordPress hosts do this for you.
Ready to get the padlock?
Every Hostiko hosting plan includes free auto-renewing Let's Encrypt SSL. Pay with M-Pesa, your site is live with HTTPS in under 15 minutes.
Already with us and want to confirm SSL is on? Open your client dashboard → Domains → SSL Status. If anything is yellow, our team fixes it for free.