I put SSL on everything except my client dev server. I use LetsEncrypt for most things but you can get super inexpensive basic validation SSL certs from Namecheap. I buy all my paid for SSL certificates from them and the process has been absolutely painless.