Why HTTPS matters
Browsers label sites without working SSL as "Not secure", which scares off customers. Google prefers secure pages.
Security headers
Headers such as HSTS and Content Security Policy are small settings on your server that help stop common attacks. Your host or web developer can usually switch them on in minutes.