Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites

A pipe bursts on a Sunday morning. The homeowner searches for an emergency plumber, taps a result with good reviews and opens its website to check the service area. The address bar says "Not secure". The same label greets a patient filling in an insurance form on a dental website, an accident victim describing a case to a law firm, and a supporter typing a card number into a nonprofit's donation page.

That label appears when a website has no SSL certificate, the file that lets a website load over a secure connection with the padlock showing. Most hosts now provide one free and renew it automatically, so a missing certificate is rarely about cost. It is about how the website was built and whether anyone is still looking after it.

The platform is the clearest dividing line. Custom-built law firm websites go without a certificate 5% of the time, more than 16 times the 0.3% on WordPress, and no business website on Wix in any of six industries is without one. By industry, plumbing websites are the most likely to show the warning, at 3.3%, and restaurant websites the least, at 1.8%.

In September 2026 we checked the security certificates of US business websites in six industries: 689 plumbing companies, 771 dental practices, 867 law firms, 275 restaurants, 401 churches and 753 nonprofits. Each website was taken from a US Google Business Profile, the free listing a business keeps on Google Search and Maps. We ran the same check on 26,636 business websites across all industries as a benchmark. For each website we recorded whether it serves a certificate, who issued it, when it expires and which platform it is built on.

An SSL certificate lets a website load over a secure https:// connection. A website with no SSL certificate can only load over plain http://, so every browser labels it "Not secure" and anything typed into its forms travels unencrypted. Certificates also expire. Most hosts renew free certificates automatically about 30 days before the end date, so a certificate within 14 days of expiry is one whose renewal has not happened yet; if it lapses, visitors get a full-page warning instead of the website. "Custom-built or other platforms" covers websites that are hand-coded or run on less common systems, rather than WordPress or a hosted builder such as Wix or Squarespace.

That is about one plumbing website in 30, the highest rate of the six industries, ahead of nonprofits at 3.1%, churches at 3% and law firms at 2.9%. All four sit above the 2.4% across 26,636 business websites. Dental practices, at 2.1%, and restaurants, at 1.8%, sit below it.

The cost of the warning depends on what the page asks for. A plumbing customer often calls within a minute of landing on the website, so a "Not secure" label is a reason to call the next company instead. A dental practice asks for dates of birth and insurance details, a law firm's case evaluation form asks what happened and who was hurt, and a nonprofit's donation form asks for a card number. On each of those websites without a certificate, the warning sits on exactly the page where trust matters most.

Restaurants do best. Many use hosted builders and online ordering platforms that issue and renew certificates automatically, which leaves fewer certificates for an owner to forget. Churches and nonprofits are often run by volunteers, and when the person who set up the hosting moves on, nobody may know how the website is secured.

In every industry, custom-built websites and those on less common platforms have the highest rate without a certificate. 6.1% of custom-built nonprofit websites and 6% of custom-built plumbing websites have no SSL certificate. Custom-built law firm websites go without one 5% of the time, more than 16 times the 0.3% of law firm websites on WordPress, and custom-built nonprofit websites more than 15 times the 0.4% on WordPress.

The table shows the share of each industry's websites on that platform with no SSL certificate. Wix issues and renews a certificate for every site, so none of the Wix websites in the six industries is without one. Most WordPress hosts now do the same, which keeps WordPress at or below 0.4% everywhere except churches, where 3% of church websites on WordPress have no certificate, a higher WordPress rate than in any other industry here.

The gap points to setup rather than size or budget. A website commissioned years ago from a freelancer or a volunteer, on hosting nobody has reviewed since, is the kind that never had a certificate added. Many of those websites still look professional; the problem sits in the hosting underneath.

How exposed an industry is depends on how many of its websites sit on custom builds. Restaurants have the largest custom-built share, 51.7%, yet the lowest rate without SSL inside that group, 1.7%. Nonprofits have the smallest custom-built share, 26%, but the highest rate without SSL inside it.

Churches have the largest share on Wix of the six industries, 15.2%, with another 10.1% on Squarespace, and those are the church websites where volunteers never have to think about certificates. Law firms and dental practices are the most likely to run on WordPress, at 50.7% and 49.7%.

A certificate close to its end date is where a failed automatic renewal turns into a full-page warning. 6.1% of plumbing websites have a certificate that expires within 30 days, the highest rate of the six industries, followed by churches at 5.2%, against 4.7% across all business websites. Plumbing also leads on the 14-day window, at 1.3%, with law firms second at 1%.

Fully lapsed certificates are rare because most renew themselves: 4 of 586 plumbing websites, 4 of 744 law firm websites, 2 of 596 dental websites, 2 of 631 nonprofit websites and 1 of 355 church websites checked in detail. Not one restaurant website served an expired or invalid certificate, the only one of the six industries with none, and restaurants also have the lowest 30-day rate, 2.2%, under half the rate across all business websites.

Automatic renewal works until something around it changes: a hosting account lapses, a website moves to a new host, or the person who set it up leaves. In a volunteer-run church or a small trade business, that is exactly when nobody is watching the end date.

A certificate no longer costs money. In every industry, most websites with a certificate use a free one that renews automatically, led by Let's Encrypt and Google Trust Services. Churches rely on Let's Encrypt most, at 68.8%, the highest share of the six industries.

Commercial certificates are a small minority: DigiCert issues 2.9% of law firm certificates and 3% of restaurant certificates. With free, self-renewing certificates this common, a website that still shows "Not secure" is one that nobody has set up properly, not one that could not afford to.

Open your website on your phone and look at the address bar, then do the same for every page that collects information: contact and quote forms, booking and new patient pages, case evaluation forms, giving and donation pages. Each should show the padlock, and typing the plain http:// address should take you to https://. Make sure the certificate covers both the www and non-www versions of your address.

If there is no certificate, ask your host to add a free one today and redirect every page to HTTPS. If there is one, check when it expires and confirm it renews automatically. Keep hosting and domain logins in an account the business or organisation owns, not one person's email, so someone can always renew or fix it.

If your website is an older custom build that your host cannot easily secure, it is probably holding you back in other ways too. Ongoing website management covers certificates, renewals, hosting and uptime, so a "Not secure" warning never reaches a customer, patient, client or donor.

Embed this research

Cite this study