Yes, without exception. Browsers mark plain HTTP pages 'Not secure' next to your name, Google has counted HTTPS as a ranking signal for years, and any form on an insecure page is transmitting visitor data in the open.
It's also free and usually one toggle: every mainstream host issues certificates (Let's Encrypt) automatically. If a host wants meaningful money for 'SSL', that's a signal about the host.
One follow-through matters: redirect all HTTP addresses to HTTPS so old links and bookmarks land securely, and update anywhere your URL is written. Your host's guide covers it in minutes.