Browsers have marked plain HTTP pages as "Not Secure" for years. Certificates have been free for longer. And yet a surprising number of small business websites still load with that warning in the address bar — which makes it one of the most reliable signals of a site nobody has looked at in a very long time.
The missing certificate is rarely the real problem. It's a symptom, and the diagnosis is usually one of these: the person who built the site left years ago, nobody has logged into the hosting since, or the business doesn't know a website needs any maintenance at all.
So when you find one, you're not looking at a business with a certificate problem. You're looking at a business whose entire web presence has been unattended for years — which means the rest of it will be dated too.
The last two are common and cheap to fix, which makes them a good first job.
The key idea: the missing certificate is almost never worth selling on its own. It's a marker that the whole site has been abandoned, and it's the easiest thing to show an owner who hasn't realised that yet.
Three things, in descending order of importance.
Trust, immediately. A visitor sees a warning before they see the business. Some leave on the spot, and almost none will type a phone number or an address into a form on that page.
Search. HTTPS has been a ranking signal for years. Not a large one, but it's a handicap the competitors don't carry.
Forms. Browsers warn more aggressively when a user types into an unsecured field, which is precisely where the enquiry would have come from.
This is the sensitive part. Security language invites the suspicion that you're the person phoning about their car warranty.
Stay concrete and unalarmed: "When I opened your site, Chrome showed a Not Secure warning next to the address. It's usually a quick fix, but it's probably putting people off before they get to the page." Factual, checkable, no urgency theatre.
Then let them look. They'll see it, and the reaction is usually surprise rather than scepticism — which is a far better place to start than defensiveness.
Be straight about which case you're in, because the range is wide.
Modern hosting with a one-click certificate and no mixed content: under an hour, and it would be hard to justify charging much for it.
Certificate plus mixed content to chase through a site's templates and content: half a day to a day, depending on how much is hardcoded.
Hosting so old it can't issue certificates at all, with no logins available: that's a migration, and it's a different project with a different price. Discovering this after quoting the first case is a bad week.
Treat the certificate as the opening job, not the engagement. It's small, it's visible, and it gets you inside the hosting account — where you'll see the rest: the outdated platform, the unpatched plugins, the backups that don't exist.
Fix the visible thing first, report what else you found, and let the owner decide. That sequence builds far more trust than arriving with a list.
You can spot this one from outside without opening much — but doing it across a whole trade still means loading every site individually.
It's among the simplest things to check in bulk. A LeadCrawlr scan flags which businesses in a trade and area are still serving over HTTP, alongside the other technical failures — and because the certificate correlates so strongly with general neglect, those businesses tend to score badly across the board. That overlap is what makes them worth contacting first.
LeadCrawlr scans Google Maps, scores every business website 1–10, and flags the ones that need you most. $49/year, unlimited scans.
Get LeadCrawlr — $49 / year