Shared SSL That Shows the Host's Name

The address that changes at the form

A visitor clicks Book an appointment. The page opens, the padlock appears, and the address bar no longer shows the business's domain.

Instead it shows the hosting company's server name followed by the account's username: a long address that looks nothing like the site they were on a moment ago.

This is shared SSL. Some hosts offer it free: secure pages use the host's own certificate, so they have to live at the host's address rather than yours.

The connection is encrypted. The visitor simply has no way to tell that it is still your business asking.

Why visitors hesitate

• The domain changes just as they are asked for personal details.
• The address holds a server name and a username, like a phishing link.
• Banks and email providers tell people to check the address before typing.
• The page often loses the site's menu and some of its design.
• Links and bookmarks to the form carry no trace of the business name.

The third is why this matters more every year. People have been told to check the address bar before entering anything, and shared SSL asks them to ignore that advice at the worst possible moment.

Why hosts offered it

Not long ago, a certificate in your own domain's name came with an annual fee and, on many servers, a dedicated IP address that cost extra.

Shared SSL let a small site encrypt a form without either cost, and for a while it was a sensible compromise.

Both costs have largely gone. Current browsers can handle many certificates on one IP address, and a basic certificate is inexpensive, sometimes free.

A certificate for your own domain

A domain-validated certificate confirms that whoever installed it controls the domain. It puts the padlock and https in front of your own address, which is what most small business sites need.

Organisation-validated and extended validation certificates also check the business itself. Extended validation shows the company name in the address bar, and costs more for that.

Most hosts sell domain-validated certificates for a modest yearly fee and will install one for you. Make sure it covers the address both with www and without it.

Free certificates are on their way

Let's Encrypt, a free certificate authority supported by several large internet organisations, has been issuing domain-validated certificates in public beta since December.

Its certificates are short-lived and meant to renew themselves on the server, so whether one suits your site depends largely on your host. Ask. If the answer is no, a paid certificate does exactly the same job for your visitors.

A worked example

A registered dietitian in private practice sees clients in a shared clinic and by phone, and asks new clients to complete an intake form before their first appointment.

The form asks about health history, medications and goals. When the site was built, the host offered shared SSL, so the form was placed on the host's secure address.

Clients who clicked the link to the intake form arrived at an address made of the host's server name and the account's username, with nothing of the practice's name in it.

Some phoned to ask whether the form was really hers. Others left it blank, and the first appointment began with twenty minutes of paperwork.

The host installed a domain-validated certificate for her domain, and the whole site moved to https.

The form now sits at her own address under the same menu as every other page, and the copy at the shared address was removed.

Move the whole site, not just the form

Once the domain has its own certificate, put every page on https rather than only the form. Visitors moving between encrypted and plain pages watch the padlock come and go.

Google has treated HTTPS as a light ranking signal since 2014, and browser makers have said they eventually want plain HTTP pages marked as not secure.

Send each old http address to its https equivalent with a permanent redirect, so links, bookmarks and search listings from before the move still arrive at the secure page.

What breaks in the move

Mixed content is the usual problem: a secure page that loads an image, script or font over plain http. Browsers then swap the padlock for a warning symbol, or refuse to load the item.

The usual sources are old links inside pages, embedded maps or videos with old code, and themes that write http addresses into every page.

Update the site address in WordPress or whatever runs the site, the sitemap, Google My Business, social profiles and any ads. Search Console treats the https address as a different site, so add it there too.

Where the answers go next

A certificate protects the connection between the visitor's browser and your server. It says nothing about what happens to the answers once they arrive.

Many forms simply email each submission to an inbox. For a form that asks about health, money or family, ask whoever built it where submissions go, who can read them and how long they are kept.

The padlock settles the visitor's first doubt. Looking after what they send remains the business's own job.

The counter-case

A site with no forms, no logins and nothing for sale has less urgency, and may reasonably move to https at its next redesign rather than this month.

Booking and payment systems run by other companies often live at their own secure addresses. That is normal when the address clearly belongs to a known booking or payment service.

What should not happen is your own form, on your own site, appearing under the host's name. For any page that asks for personal details, a certificate for your own domain is now the standard.

Moving off shared SSL

1. Click through to each form and read the address.
2. Ask your host which certificates it offers.
3. Install one covering www and the bare domain.
4. Redirect every http page to its https address.
5. Fix mixed content warnings page by page.
6. Update Search Console and your listings.
7. Check where form answers are sent and kept.

Step four is the one that finishes the job. A certificate that protects only the form leaves every other page on plain http, and visitors still watch the padlock appear and vanish as they move around.

Checking the signature on a certificate you already have is covered in certificates signed with SHA-1 are no longer issued.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.