An SSL certificate proves your domain is what it claims to be and enables the encrypted HTTPS connection between a visitor’s browser and your server. Without one, browsers mark the site as not secure and most visitors leave.
Getting one
Nearly every host now issues free Let’s Encrypt certificates from the control panel, renewed automatically. Paid certificates exist and are worth it mainly for organisations that need extended validation; for a normal site the free one is identical in strength.
After installing it
Update the WordPress Address and Site Address to the https version, then check for mixed content, images or scripts still loading over http, which keeps the padlock from appearing. A search-and-replace across the database usually clears the remaining references.