Well nowadays you can get a certificate entirely for free from Let's Encrypt, but as for why, the site https://doesmysiteneedhttps.com/ covers it better than I can