No need to pay for an SSL certificate.
Letsencrypt offer a simple system to have a free SSL certificate.
Cloudflare also provide free SSL certificates, with subdomain wildcards and valide for 15 years.
The only certificate that require to pay is the EV SSL Certificate, with company validation to display the company name in the green bar.
But for the security of a website, a letsencrypt certificate or a paid certificates will offer the same level of security. Only the certificate installation should be done properly, because even with a 300$ SSL certificate, if you don't install it properly, it will not protect anything.
To check if an SSL certificate is properly setup, you can use
SSLLabs
Cloudflare certificate :
Letsencrypt SSL certificate :
