The short version: yes, HTTPS is a ranking signal, and no, switching to it will not move you up the results page on its own.
Google confirmed HTTPS as a lightweight signal back in 2014 and has described it as a tie-breaker between otherwise equal results. Anyone selling you a certificate on the promise of a ranking jump is overselling. The genuine reasons to move are bigger than the ranking one, and they are worth understanding properly.
Reason one: browsers now shame you
This is the one that actually costs you money. Every current browser marks pages served over plain HTTP as Not secure in the address bar. On any page with a form — a login, a contact form, a checkout — that warning becomes prominent and alarming.
Your visitor does not know what a certificate is. They know the browser told them your site is not safe, at the exact moment you asked them to type something. No ranking factor costs you as much as that does.
Reason two: you are losing your referral data
This one is invisible, which is why it goes unnoticed for years.
When someone clicks from an HTTPS site to an HTTP site, the browser strips the referrer information for privacy. Your analytics cannot see where that visitor came from, so it files them under direct traffic.
Almost the entire web is HTTPS now. So if your site is not, a large share of your incoming traffic arrives anonymous, and your analytics quietly understates every referral source you have. People make marketing decisions on that data.
Reason three: modern features require it
HTTP/2 and HTTP/3, which make sites meaningfully faster, require HTTPS in every browser that implements them. So do service workers, geolocation, and the APIs behind modern checkout flows. Staying on HTTP does not just leave you insecure — it locks you out of the performance features that do affect rankings.
That is the honest version of "SSL helps SEO": not directly, but it is the gate you must pass through to reach the things that do.
Do you need to pay for a certificate?
For most sites, no. Free automatic certificates are issued and renewed for you, they use the same encryption as paid ones, and browsers treat them identically. There is no green-padlock tier that visitors can see.
Paid certificates are worth it in two specific cases: you need a wildcard covering many subdomains at once, or you want extended validation, where the certificate authority verifies your legal identity — occasionally required in finance and by some enterprise procurement. Outside those, a free certificate is not a lesser product.
Switching without breaking things
Two things go wrong, and both are easy to avoid.
Mixed content. If your pages load images, scripts or stylesheets over http://, the browser blocks or flags them and your padlock disappears. Search your content and templates for hardcoded http:// URLs pointing at your own domain and update them.
Missing redirects. After switching, the HTTP version of every page must 301-redirect to the HTTPS version. Without that you have two copies of your site, search engines have to work out which is canonical, and any link equity you have is split between them.
Where OIS fits
Every plan includes free SSL, issued and renewed automatically — there is nothing to buy, install or remember. You can force HTTPS for your whole site from your control panel, which handles the redirect part for you.
If you need a wildcard or an extended-validation certificate, we sell those too. And if you are moving an older HTTP site across, mixed content is the thing to check first; ask us and we will look at it with you.