---
title: "SSL Certificate Statistics: Custom Sites Lack One Up to 16x"
url: https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry
description: "SSL certificate statistics for six industries: 5% of custom-built law firm websites have none, over 16 times the 0.3% on WordPress. Read the study."
lang: en
---
Share
Share on X: https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fssl-certificates-by-industry&text=Custom-Built%20Business%20Websites%20Go%20Without%20SSL%20Up%20to%2016%20Times%20as%20Often%20as%20WordPress%20Sites
Share on Facebook: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fssl-certificates-by-industry
Share on LinkedIn: https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fssl-certificates-by-industry
Share on Reddit: https://www.reddit.com/submit?url=https%3A%2F%2Fwww.suffdigital.com%2Fresources%2Fdata-studies%2Fssl-certificates-by-industry&title=Custom-Built%20Business%20Websites%20Go%20Without%20SSL%20Up%20to%2016%20Times%20as%20Often%20as%20WordPress%20Sites
Custom-built law firm websites have no SSL certificate **5%** of the time, more than 16 times the 0.3% of law firm websites on WordPress, and across six industries not one website built on Wix is without a certificate. Plumbing websites are the most likely to go without, at 3.3%, nearly twice the 1.8% of restaurant websites.
Analysis of US plumbing, dental, law firm, restaurant, church and nonprofit websites, compared with 26,636 business websites · websites listed on US Google Business Profiles, September 2026
## Key Findings
1. 1. **5%** of custom-built law firm websites have no SSL certificate, more than 16 times the 0.3% of law firm websites on WordPress. Copy stat
2. 2. **0%** of business websites built on Wix lack an SSL certificate, in every one of six industries, because Wix issues and renews a certificate for every site. Copy stat
3. 3. **3.3%** of plumbing websites have no SSL certificate, so browsers label them "Not secure", the highest rate of six industries and nearly twice the 1.8% of restaurant websites. Copy stat
4. 4. **2.4%** of US business websites have no SSL certificate, and plumbing, nonprofit, church and law firm websites all sit above that rate. Copy stat
5. 5. **6.1%** of plumbing websites have a certificate that expires within 30 days, the highest rate of six industries, against 4.7% across all business websites. Copy stat
6. 6. **0%** of restaurant websites served an expired or invalid certificate, the only one of six industries with none. Copy stat
7. 7. **68.8%** of church websites with a certificate use a free Let's Encrypt certificate, the highest share of six industries. Copy stat
## Summary
A pipe bursts on a Sunday morning. The homeowner searches for an emergency plumber, taps a result with good reviews and opens its website to check the service area. The address bar says "Not secure". The same label greets a patient filling in an insurance form on a dental website, an accident victim describing a case to a law firm, and a supporter typing a card number into a nonprofit's donation page.
That label appears when a website has no SSL certificate, the file that lets a website load over a secure connection with the padlock showing. Most hosts now provide one free and renew it automatically, so a missing certificate is rarely about cost. It is about how the website was built and whether anyone is still looking after it.
The platform is the clearest dividing line. Custom-built law firm websites go without a certificate **5%** of the time, more than 16 times the 0.3% on WordPress, and no business website on Wix in any of six industries is without one. By industry, plumbing websites are the most likely to show the warning, at 3.3%, and restaurant websites the least, at 1.8%.
## What we measured
In September 2026 we checked the security certificates of US business websites in six industries: 689 plumbing companies, 771 dental practices, 867 law firms, 275 restaurants, 401 churches and 753 nonprofits. Each website was taken from a US Google Business Profile, the free listing a business keeps on Google Search and Maps. We ran the same check on 26,636 business websites across all industries as a benchmark. For each website we recorded whether it serves a certificate, who issued it, when it expires and which platform it is built on.
An SSL certificate lets a website load over a secure https:// connection. A website with no SSL certificate can only load over plain http://, so every browser labels it "Not secure" and anything typed into its forms travels unencrypted. Certificates also expire. Most hosts renew free certificates automatically about 30 days before the end date, so a certificate within 14 days of expiry is one whose renewal has not happened yet; if it lapses, visitors get a full-page warning instead of the website. "Custom-built or other platforms" covers websites that are hand-coded or run on less common systems, rather than WordPress or a hosted builder such as Wix or Squarespace.
## Plumbing websites are the most likely to have no SSL
3.3%
of plumbing websites have no SSL certificate.
That is about one plumbing website in 30, the highest rate of the six industries, ahead of nonprofits at 3.1%, churches at 3% and law firms at 2.9%. All four sit above the 2.4% across 26,636 business websites. Dental practices, at 2.1%, and restaurants, at 1.8%, sit below it.
No SSL certificate by industry
Plumbing
3.3%
Nonprofit
3.1%
Church
3%
Law firm
2.9%
All business websites
2.4%
Dental
2.1%
Restaurant
1.8%
Source: Suff Digital analysis of US plumbing, dental, law firm, restaurant, church and nonprofit websites, compared with 26,636 business websites · websites listed on US Google Business Profiles, September 2026
| Industry | Websites | No SSL certificate |
| --- | --- | --- |
| Plumbing | 689 | 3.3% |
| Nonprofit | 753 | 3.1% |
| Church | 401 | 3% |
| Law firm | 867 | 2.9% |
| All business websites | 26,636 | 2.4% |
| Dental | 771 | 2.1% |
| Restaurant | 275 | 1.8% |
The cost of the warning depends on what the page asks for. A plumbing customer often calls within a minute of landing on the website, so a "Not secure" label is a reason to call the next company instead. A dental practice asks for dates of birth and insurance details, a law firm's case evaluation form asks what happened and who was hurt, and a nonprofit's donation form asks for a card number. On each of those websites without a certificate, the warning sits on exactly the page where trust matters most.
Restaurants do best. Many use hosted builders and online ordering platforms that issue and renew certificates automatically, which leaves fewer certificates for an owner to forget. Churches and nonprofits are often run by volunteers, and when the person who set up the hosting moves on, nobody may know how the website is secured.
## Custom-built websites are the ones without SSL
6.1%
of custom-built nonprofit websites have no SSL certificate.
In every industry, custom-built websites and those on less common platforms have the highest rate without a certificate. 6.1% of custom-built nonprofit websites and 6% of custom-built plumbing websites have no SSL certificate. Custom-built law firm websites go without one 5% of the time, more than 16 times the 0.3% of law firm websites on WordPress, and custom-built nonprofit websites more than 15 times the 0.4% on WordPress.
Custom-built or other platforms by industry
Nonprofit
6.1%
Plumbing
6%
Law firm
5%
Dental
4.3%
Church
3.8%
Restaurant
1.7%
| Industry | Custom-built or other platforms | WordPress | Squarespace | Wix |
| --- | --- | --- | --- | --- |
| Nonprofit | 6.1% | 0.4% | 0% | 0% |
| Plumbing | 6% | 0% | 0% | 0% |
| Law firm | 5% | 0.3% | 3% | 0% |
| Dental | 4.3% | 0.3% | 3.4% | 0% |
| Church | 3.8% | 3% | 0% | 0% |
| Restaurant | 1.7% | 0% | 0% | 0% |
The table shows the share of each industry's websites on that platform with no SSL certificate. Wix issues and renews a certificate for every site, so none of the Wix websites in the six industries is without one. Most WordPress hosts now do the same, which keeps WordPress at or below 0.4% everywhere except churches, where 3% of church websites on WordPress have no certificate, a higher WordPress rate than in any other industry here.
The gap points to setup rather than size or budget. A website commissioned years ago from a freelancer or a volunteer, on hosting nobody has reviewed since, is the kind that never had a certificate added. Many of those websites still look professional; the problem sits in the hosting underneath.
## How much of each industry is custom-built
How exposed an industry is depends on how many of its websites sit on custom builds. Restaurants have the largest custom-built share, 51.7%, yet the lowest rate without SSL inside that group, 1.7%. Nonprofits have the smallest custom-built share, 26%, but the highest rate without SSL inside it.
Restaurant
51.7%
Church
44.2%
Plumbing
42.3%
Dental
35.2%
Law firm
34.8%
Nonprofit
26%
| Industry | Custom-built or other platforms | WordPress | Wix | Squarespace |
| --- | --- | --- | --- | --- |
| Restaurant | 51.7% | 25.6% | 7.7% | 9.8% |
| Church | 44.2% | 28.5% | 15.2% | 10.1% |
| Plumbing | 42.3% | 42.8% | 6.3% | 5.1% |
| Dental | 35.2% | 49.7% | 4.5% | 4.9% |
| Law firm | 34.8% | 50.7% | 6.6% | 4.4% |
| Nonprofit | 26% | 44.8% | 10.6% | 13% |
Churches have the largest share on Wix of the six industries, 15.2%, with another 10.1% on Squarespace, and those are the church websites where volunteers never have to think about certificates. Law firms and dental practices are the most likely to run on WordPress, at 50.7% and 49.7%.
## Plumbing and church websites run closest to expiry
A certificate close to its end date is where a failed automatic renewal turns into a full-page warning. 6.1% of plumbing websites have a certificate that expires within 30 days, the highest rate of the six industries, followed by churches at 5.2%, against 4.7% across all business websites. Plumbing also leads on the 14-day window, at 1.3%, with law firms second at 1%.
Certificate expires within 14 days by industry
Plumbing
1.3%
Church
0.7%
All business websites
0.9%
Law firm
1%
Nonprofit
0.3%
Dental
0.4%
Restaurant
0.4%
| Industry | Certificate expires within 14 days | Certificate expires within 30 days |
| --- | --- | --- |
| Plumbing | 1.3% | 6.1% |
| Church | 0.7% | 5.2% |
| All business websites | 0.9% | 4.7% |
| Law firm | 1% | 3.6% |
| Nonprofit | 0.3% | 3.6% |
| Dental | 0.4% | 2.7% |
| Restaurant | 0.4% | 2.2% |
Fully lapsed certificates are rare because most renew themselves: 4 of 586 plumbing websites, 4 of 744 law firm websites, 2 of 596 dental websites, 2 of 631 nonprofit websites and 1 of 355 church websites checked in detail. Not one restaurant website served an expired or invalid certificate, the only one of the six industries with none, and restaurants also have the lowest 30-day rate, 2.2%, under half the rate across all business websites.
Automatic renewal works until something around it changes: a hosting account lapses, a website moves to a new host, or the person who set it up leaves. In a volunteer-run church or a small trade business, that is exactly when nobody is watching the end date.
## Free certificates now secure most business websites
A certificate no longer costs money. In every industry, most websites with a certificate use a free one that renews automatically, led by Let's Encrypt and Google Trust Services. Churches rely on Let's Encrypt most, at 68.8%, the highest share of the six industries.
Let's Encrypt by industry
Church
68.8%
Nonprofit
63.2%
Law firm
62.6%
Plumbing
59.3%
Dental
54.4%
Restaurant
53.4%
| Industry | Let's Encrypt | Google Trust Services |
| --- | --- | --- |
| Church | 68.8% | 19.7% |
| Nonprofit | 63.2% | 25% |
| Law firm | 62.6% | 24.8% |
| Plumbing | 59.3% | 31.4% |
| Dental | 54.4% | 32.6% |
| Restaurant | 53.4% | 31.9% |
Commercial certificates are a small minority: DigiCert issues 2.9% of law firm certificates and 3% of restaurant certificates. With free, self-renewing certificates this common, a website that still shows "Not secure" is one that nobody has set up properly, not one that could not afford to.
## What this means for business owners
Open your website on your phone and look at the address bar, then do the same for every page that collects information: contact and quote forms, booking and new patient pages, case evaluation forms, giving and donation pages. Each should show the padlock, and typing the plain http:// address should take you to https://. Make sure the certificate covers both the www and non-www versions of your address.
If there is no certificate, ask your host to add a free one today and redirect every page to HTTPS. If there is one, check when it expires and confirm it renews automatically. Keep hosting and domain logins in an account the business or organisation owns, not one person's email, so someone can always renew or fix it.
If your website is an older custom build that your host cannot easily secure, it is probably holding you back in other ways too. Ongoing website management (https://www.suffdigital.com/services/website-maintenance/website-management) covers certificates, renewals, hosting and uptime, so a "Not secure" warning never reaches a customer, patient, client or donor.
## Embed this research
Paste this on your site to embed the charts. It links back to the source automatically.
Source: Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites - Suff Digital
## Cite this study
APA
Suff Digital. (2026). Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites. https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry
Plain link
Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites - Suff Digital - https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry
## Frequently asked questions
### Which industry is most likely to have a website with no SSL certificate?
### Which industry is least likely to have a website with no SSL certificate?
### Which business websites are most likely to lack SSL?
### Do Wix websites have SSL certificates?
### How many business websites have an SSL certificate about to expire?
### Why does my business website say Not secure?
## Related studies
- Website Migration 20.8% of Real Estate Websites Still Load Without HTTPS vs 9.5% of Small Business Websites: https://www.suffdigital.com/resources/data-studies/small-business-https-redirect
- Website Maintenance 61.6% of Websites Skip HSTS, the Security Header That Forces Secure Connections: https://www.suffdigital.com/resources/data-studies/hsts-security-header-missing
- Website Migration 659,120 Secure Homepages Still Load Files Over Insecure HTTP: https://www.suffdigital.com/resources/data-studies/mixed-content-https-websites
- Website Migration 37% of Small Business Websites on HTTPS Still Link to Insecure HTTP Addresses: https://www.suffdigital.com/resources/data-studies/http-links-on-https-sites
## Structured data
```json
[
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Organization",
"@id": "https://www.suffdigital.com/#organization",
"name": "Suff Digital",
"alternateName": "Suff Digital Marketing",
"url": "https://www.suffdigital.com/",
"logo": {
"@type": "ImageObject",
"@id": "https://www.suffdigital.com/#logo",
"url": "https://www.suffdigital.com/logo.png",
"contentUrl": "https://www.suffdigital.com/logo.png",
"caption": "Suff Digital"
},
"image": {
"@id": "https://www.suffdigital.com/#logo"
},
"description": "Suff Digital is a full-stack digital marketing agency that turns websites into predictable revenue engines, SEO, paid media, content, CRO, and web design built around revenue, not vanity metrics.",
"slogan": "Digital marketing built for what's next.",
"email": "hello@suffdigital.com",
"telephone": "+1-629-236-0099",
"foundingDate": "2022",
"founder": {
"@type": "Person",
"name": "Matt Suffoletto",
"jobTitle": "Founder & CEO"
},
"contactPoint": [
{
"@type": "ContactPoint",
"telephone": "+1-629-236-0099",
"email": "hello@suffdigital.com",
"contactType": "sales",
"areaServed": "US",
"availableLanguage": [
"en"
]
}
],
"address": {
"@type": "PostalAddress",
"addressLocality": "Nashville",
"addressRegion": "TN",
"postalCode": "37219",
"addressCountry": "US"
},
"areaServed": {
"@type": "Country",
"name": "United States"
},
"sameAs": [
"https://www.linkedin.com/company/suff-digital/",
"https://www.instagram.com/suffdigital/",
"https://www.youtube.com/@suffdigitalmarketing",
"https://www.tiktok.com/@suffdigital"
],
"knowsAbout": [
"Search Engine Optimization",
"Pay-Per-Click Advertising",
"Paid Social Advertising",
"Conversion Rate Optimization",
"Web Design",
"Digital PR",
"Link Building",
"Website Migration",
"Website Maintenance and Support",
"Technical SEO",
"Local SEO",
"AI Search Optimization"
],
"hasOfferCatalog": {
"@type": "OfferCatalog",
"name": "Suff Digital Services",
"itemListElement": [
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Search Engine Optimization (SEO)",
"url": "https://www.suffdigital.com/"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Pay-Per-Click (PPC) Advertising",
"url": "https://www.suffdigital.com/services/ppc"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Paid Social Advertising",
"url": "https://www.suffdigital.com/services/paid-social"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Conversion Rate Optimization (CRO)",
"url": "https://www.suffdigital.com/services/cro"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Web Design",
"url": "https://www.suffdigital.com/services/web-design"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Digital PR & Link Building",
"url": "https://www.suffdigital.com/services/digital-pr"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Website Migration",
"url": "https://www.suffdigital.com/services/website-migration"
}
},
{
"@type": "Offer",
"itemOffered": {
"@type": "Service",
"name": "Website Maintenance & Support",
"url": "https://www.suffdigital.com/services/website-maintenance"
}
}
]
}
},
{
"@type": "WebSite",
"@id": "https://www.suffdigital.com/#website",
"url": "https://www.suffdigital.com/",
"name": "Suff Digital",
"inLanguage": "en-US",
"publisher": {
"@id": "https://www.suffdigital.com/#organization"
}
}
]
},
{
"@context": "https://schema.org",
"@graph": [
{
"@type": "Article",
"@id": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry#article",
"headline": "Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites",
"description": "Custom-built law firm websites have no SSL certificate 5% of the time, more than 16 times the 0.3% of law firm websites on WordPress, and across six industries not one website built on Wix is without a certificate. Plumbing websites are the most likely to go without, at 3.3%, nearly twice the 1.8% of restaurant websites.",
"image": [
"https://www.suffdigital.com/images/suff-digital-share-16x9.jpg"
],
"url": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry",
"datePublished": "2026-09-24",
"dateModified": "2026-09-24",
"author": {
"@type": "Person",
"name": "Matt Suffoletto",
"jobTitle": "Founder & CEO",
"url": "https://www.suffdigital.com/who-we-are"
},
"publisher": {
"@id": "https://www.suffdigital.com/#organization"
},
"mainEntityOfPage": {
"@id": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry",
"@type": "WebPage"
},
"isPartOf": {
"@id": "https://www.suffdigital.com/#website"
}
},
{
"@type": "BreadcrumbList",
"@id": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry#breadcrumb",
"itemListElement": [
{
"@type": "ListItem",
"position": 1,
"name": "Home",
"item": "https://www.suffdigital.com/"
},
{
"@type": "ListItem",
"position": 2,
"name": "Resources",
"item": "https://www.suffdigital.com/resources"
},
{
"@type": "ListItem",
"position": 3,
"name": "Data Studies",
"item": "https://www.suffdigital.com/resources/data-studies"
},
{
"@type": "ListItem",
"position": 4,
"name": "Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites"
}
]
},
{
"@type": "Dataset",
"@id": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry#dataset",
"name": "Custom-Built Business Websites Go Without SSL Up to 16 Times as Often as WordPress Sites",
"description": "Custom-built law firm websites have no SSL certificate 5% of the time, more than 16 times the 0.3% of law firm websites on WordPress, and across six industries not one website built on Wix is without a certificate. Plumbing websites are the most likely to go without, at 3.3%, nearly twice the 1.8% of restaurant websites.",
"url": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry",
"creator": {
"@id": "https://www.suffdigital.com/#organization"
},
"datePublished": "2026-09-24",
"dateModified": "2026-09-24",
"license": "https://creativecommons.org/licenses/by/4.0/",
"isAccessibleForFree": true,
"measurementTechnique": "Websites listed on US Google Business Profiles"
},
{
"@type": "FAQPage",
"@id": "https://www.suffdigital.com/resources/data-studies/ssl-certificates-by-industry#faq",
"mainEntity": [
{
"@type": "Question",
"name": "Which industry is most likely to have a website with no SSL certificate?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Plumbing. 3.3% of plumbing websites have no SSL certificate, the highest rate of six industries, ahead of nonprofits at 3.1% and churches at 3%, against 2.4% across 26,636 US business websites."
}
},
{
"@type": "Question",
"name": "Which industry is least likely to have a website with no SSL certificate?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Restaurants. 1.8% of restaurant websites have no SSL certificate, the lowest rate of six industries, and no restaurant website served an expired or invalid certificate."
}
},
{
"@type": "Question",
"name": "Which business websites are most likely to lack SSL?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Custom-built websites and those on less common platforms. 5% of custom-built law firm websites have no SSL certificate, more than 16 times the 0.3% of law firm websites on WordPress, and 6.1% of custom-built nonprofit websites go without one."
}
},
{
"@type": "Question",
"name": "Do Wix websites have SSL certificates?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. No business website built on Wix in any of six industries (plumbing, dental, law, restaurant, church and nonprofit) lacks an SSL certificate, because Wix issues and renews one for every site."
}
},
{
"@type": "Question",
"name": "How many business websites have an SSL certificate about to expire?",
"acceptedAnswer": {
"@type": "Answer",
"text": "4.7% of US business websites have a certificate that expires within 30 days and 0.9% within 14 days. Plumbing websites run closest, at 6.1% within 30 days, the highest rate of six industries."
}
},
{
"@type": "Question",
"name": "Why does my business website say Not secure?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Usually because it has no SSL certificate, the certificate has expired, or it covers a different address such as the non-www version. Your host can fix all three, and most provide a free certificate that renews automatically."
}
}
]
}
]
}
]
```