TLS

TLS is the encryption that protects data travelling between a browser and a server; HTTPS is HTTP running over it. It is what makes the padlock appear, and what stops anyone on the network between the two from reading or altering the traffic. SSL is its obsolete predecessor, though the name persists in conversation and in certificate paperwork.

It is no longer optional for any site. Browsers mark plain HTTP as insecure, search ranking accounts for it, and modern browser features simply refuse to run without it. Certificates are free and issued automatically, so cost has not been a reason for years.

What still needs attention is the configuration: automatic renewal that actually works, a redirect from HTTP, and HSTS so a browser refuses to fall back. An expired certificate is one of the few faults that takes a site completely offline for every visitor at once.