For the vast majority of company sites and stores, a free SSL certificate encrypts exactly as strongly as one costing several hundred zloty a year. A paid certificate is not stronger encryption - it is a different level of verification of who stands behind the domain, plus support and guarantees from the issuer. The padlock in the browser and the encrypted connection look identical either way. Below you get price brackets, the specific situations where paying really is worth it, and the ones where it is pure expense.
What you are actually paying for
An SSL certificate is a file signed by a trusted certificate authority confirming that a domain belongs to whoever is using it, and allowing the browser to establish an encrypted connection. The encryption itself is standardised - the TLS protocol works the same regardless of what you paid.
The price difference buys three things:
- Verification depth - whether the authority checked only the domain, or also the company’s existence in official registers
- Coverage - one domain, all subdomains (wildcard), or several different domains in one file
- The commercial wrapper - the issuer’s technical support, a financial guarantee, a site seal, a longer validity period per purchase
None of those makes the data in your customer’s form “more encrypted”.
SSL certificate pricing - realistic brackets
Issuer and reseller price lists change several times a year, so treat these numbers as an order of magnitude, not an offer. They reflect the Polish market.
| Certificate type | What it proves | Rough annual cost | For whom |
|---|---|---|---|
| Free DV (Let’s Encrypt, ZeroSSL, hosting-provided SSL) | domain ownership | 0 PLN | company site, blog, most stores |
| Paid DV | domain ownership | from a few dozen up to about 200 PLN | when you need issuer support |
Wildcard (*.yourdomain.com) | domain ownership + all subdomains | usually several hundred PLN (a free variant also exists) | many subdomains, panels, apps |
| OV - organisation validation | domain + the entity’s existence | usually several hundred PLN | banks, insurance, large B2B |
| EV - extended validation | domain + in-depth company verification | several hundred PLN and up | financial institutions, industry requirements |
There is a hidden cost on top: renewal time. A paid certificate has to be bought, uploaded and the server restarted once a year - a free one, in a well-configured environment, renews itself. That is one of the items easy to forget when counting the cost of running a site.
The free certificate - where the catch is
There is one catch and it concerns automation, not security. Free certificates are issued for short periods (Let’s Encrypt for 90 days), so they have to renew automatically. If your host does it for you - the subject disappears. If somebody uploaded a certificate by hand because “it was quicker”, in three months the site greets customers with a warning.
The second catch: a free certificate never carries company validation. If some policy, tender or a partner’s security team requires OV or EV, free is out by definition, no matter how well it works.
The third: free issuers have no helpline - your hosting provider or whoever looks after the site helps you. The full list of pros and cons I break down in the piece on free versus paid certificates.
DV, OV and EV - what that means in practice
These are three levels of what the certificate authority checked before issuing the file.
- DV (Domain Validation) - only that you control the domain. Issuance takes minutes and is often fully automatic.
- OV (Organization Validation) - company details are additionally verified against registers. Issuance usually takes a few working days and requires documents.
- EV (Extended Validation) - the deepest entity verification, the longest procedure, the highest price.
One important thing changed the maths: browsers no longer show a green bar with the company name for EV. Today a visitor sees the same padlock as with a free DV, and only somebody who opens the certificate details will notice a difference. So if anyone sells you EV with the argument “customers will see the company is real” - that argument is years out of date.
When paying really is worth it
There are four situations where a paid certificate makes sense and I recommend it myself:
- A formal requirement - a tender, a security audit, a partner’s policy or an integration with a system that explicitly demands OV or EV
- An environment with no automatic renewal - your own server, an unusual panel, an app behind a load balancer, where automation would cost more to maintain than a one-year certificate
- A need for one file across many different domains - a multi-domain certificate can be handier than managing a dozen separate ones
- A conscious need for issuer support and guarantees - if somebody in your organisation has to have a phone number for the supplier, that is a legitimate reason
Outside those cases, a paid certificate changes neither security, nor conversion, nor visibility in Google - HTTPS is a technical signal, what counts is that it works, not what it cost.
Wildcard - when you need one
A wildcard certificate is issued for *.yourdomain.com, covering all subdomains at once: store, panel, staging, api. You need one when there are many subdomains or new ones appear without warning - then a single file saves a lot of fiddling.
Two things worth knowing before you buy:
- A wildcard does not cover the bare domain without a subdomain, nor second-level subdomains -
shop.panel.yourdomain.comwill not be included. Good certificates are issued with the root domain added. - A wildcard is also available for free - Let’s Encrypt issues them, only the verification goes through a DNS record instead of a file on the server. That is slightly more setup work, but you do it once.
Have three subdomains and no plans for more? Separate certificates will be simpler and cheaper.
SSL from a registrar, from hosting, or in a hosted store platform
Where you buy changes the price more than the certificate type does - the same type can cost several times more or less depending on where you click “buy”.
- Domain registrars sell certificates as an add-on at domain renewal. Everything is on one invoice, but it is usually the most expensive route - and often unnecessary, because the same hosting includes free DV. Before you buy, check your panel for what you already have included.
- Hosting providers mostly offer free SSL with automatic renewal today, enabled with one toggle. If yours does not, that is an argument for rethinking which WordPress hosting to choose.
- Hosted store platforms (Shoper, Shopify and similar) include the certificate in the monthly fee - you do not buy it separately unless you are attaching an unusual domain setup. If a platform asks you to pay extra for SSL on your own domain, that is a negotiating point, not a necessity.
- Cloudflare in front of your site gives a free certificate at the network edge - but it does not remove the need for a certificate on the server itself if you want encryption across the whole route.
What the certificate price does not solve
The certificate alone is one third of the job - I have seen sites with an expensive OV still scaring customers with a warning, because the rest was unfinished. After uploading a certificate you still have to:
- Set up the HTTP to HTTPS redirect - otherwise the old address version lives on and duplicates content
- Fix mixed content - images, scripts and styles loaded over HTTP on an HTTPS page can remove the padlock despite a valid certificate
- Update the site address in system settings, the sitemap and analytics tools
- Check the expiry date and whether renewal actually works - ideally with an email notification, not from memory
The last point is the most common cause of SSL-related outages - a certificate does not warn you before it expires, one morning the browser simply scares customers with a red screen. What to do then, in order, I described in the piece on an expired SSL certificate.
How to sort this out on your side
I start with a free diagnosis: I check what you actually have issued, whether it renews itself, whether redirects and mixed content are handled and whether there is any point paying for anything. It ends with a concrete answer: leave it as it is, flip one toggle, or pay up because you have this specific requirement.
If it turns into real work - a migration to HTTPS, tidying up subdomains, fixing mixed content - you get scope and price in writing before the start. And if you want lasting peace, watching certificates, backups and updates falls under ongoing technical support.
Frequently asked questions
How much does an SSL certificate for one domain cost? From zero - a free DV certificate is the standard on most hosting today and is entirely sufficient for company sites and stores. Paid DV versions usually start from a few dozen zloty a year, but what you buy there is issuer support and guarantees, not stronger encryption. Price lists change often, so compare before buying.
Is a free SSL certificate worse than a paid one? Not in terms of encryption - the protocol and connection strength are the same. The difference lies in verification (free only confirms the domain), in customer service and in validity length. For a company site and a typical store, free is entirely sufficient.
How much does a wildcard certificate cost? A paid wildcard is usually in the order of several hundred zloty a year, depending on issuer and purchase length. A free version exists too - Let’s Encrypt issues wildcards after verification through a DNS record.
Does an SSL certificate affect Google rankings? Not having one hurts, but the certificate alone does not raise rankings, and a more expensive one does not work better than a free one. What has a real impact is whether the move to HTTPS was done properly - with redirects and without mixed content.
Would rather not watch over it every month yourself? I take sites and stores under ongoing care - backups, updates, monitoring, and priority when something breaks. Tell me what you run and I will send back scope and price.