Without encryption, data travels across the internet in plain text. Anyone on the same public Wi-Fi, or anyone tapping a line, can read what someone types into a form. HTTPS encrypts the connection between browser and server, and the certificate is what makes that possible. It contains the public key for the encryption and is issued by a certificate authority that browsers trust.
Strictly speaking, the name SSL is out of date. Today the technology uses its successor, TLS. In everyday use, though, almost everyone still says SSL certificate. You can recognise a secure connection by the “https://” in front of the address. If there's no encryption, the browser shows a “Not secure” warning next to the address.
For a business, HTTPS is standard today. Since version 68 in July 2018, Google Chrome has marked every page without HTTPS as “Not secure”. That puts people off, especially on contact forms. Google also counts a secure connection as one of the signs of a good user experience. And if you collect names, phone numbers or enquiries through a form, that data should be sent encrypted.
A certificate doesn't have to be expensive. The non-profit certificate authority Let’s Encrypt issues free certificates. They are usually valid for 90 days and are renewed automatically by your host. That's enough for a normal company website. Paid certificates with extra verification of the company are only needed in special cases.
What to look out for: every address with http:// should redirect automatically to https://. Images and scripts also have to load over HTTPS, otherwise the browser reports insecure content. The certificate needs to be renewed in time, ideally automatically. On our WordPress websites, we set up HTTPS and the redirect when the site goes live.
A bike repair shop in Horw has a form on its website for booking repairs. The site still runs on http://. A customer opens it on their phone and sees “Not secure” next to the address. They give up and call instead, or don't bother at all. After the switch to HTTPS, the warning disappears. Name, phone number and bike model now reach the server encrypted. The old http:// address redirects automatically to the new one, so old links and Google listings keep working.