HTTPS and SSL: what the padlock really means
The small padlock next to a web address means the connection is private and secure. It doesn't mean the website itself is trustworthy. Here's what HTTPS and SSL really do, why every business website needs them, and what to check on yours.
Look at the address bar at the top of your browser. Next to most web addresses you'll see a small padlock, or a similar icon, and the address starts with https://. On some older or neglected websites, you'll see “Not secure” instead.
That small detail matters more than it looks. This post explains what HTTPS and SSL are, what the padlock does and doesn't mean, and why every business website needs it. For how it fits with your domain and hosting, see domain, hosting and SSL.
HTTP and HTTPS
When someone visits your website, their phone and your website's server send information back and forth. HTTP is the standard way that information travels. HTTPS is the secure version: the same thing, but encrypted, so nobody in between can read or change it.
The “S” stands for secure.
SSL and TLS
The technology that makes HTTPS secure is called TLS. Its older predecessor was called SSL, and most people, including hosting companies, still say “SSL certificate” out of habit. In everyday conversation, SSL, TLS and HTTPS all point to the same thing: a secure connection.
An SSL certificate is a small digital file installed on your website's server. It proves the website really belongs to your domain and allows the secure connection to work. Certificates expire and must be renewed. On good hosting, this happens automatically.
What HTTPS protects
- Privacy: what visitors type, such as their name and phone number in your enquiry form, can't be read by anyone else on the network, for example on public Wi-Fi
- Integrity: nobody in between can secretly change your pages, for example inserting adverts or harmful links
- Authenticity: visitors are connected to the real website for your domain, not an impostor in the middle
What the padlock does not mean
This is important, and many people misunderstand it. The padlock means the connection is secure. It does not mean the website is honest, safe or legitimate.
Scam and phishing websites can, and often do, have HTTPS and a padlock. So when you're shopping or entering details elsewhere, the padlock alone isn't enough. Check that the web address is exactly the one you expect.
Why every business website needs it
Browsers warn people
Modern browsers mark websites without HTTPS as “Not secure”, especially on pages with forms. A new customer seeing that warning next to your name may leave straight away.
Forms need it
If your website has an enquiry form, customers are typing their details into it. Those details should travel securely. See WhatsApp buttons and enquiry forms.
Payments require it
Payment gateways require HTTPS. See online payments on your website.
Google prefers it
HTTPS is part of what Google looks for in a good page experience, and it's checked in Lighthouse's Best Practices score. See what is Google Lighthouse.
Modern features depend on it
Many newer browser features only work on secure sites.
What visitors see when it goes wrong
When a certificate expires or is set up incorrectly, browsers don't just show a small warning. Many show a full-page message saying the connection isn't private, with the option to continue hidden behind extra clicks. Almost every customer will turn back at that point. That's why an expired certificate can make a working website feel, to customers, as if it has disappeared.
Does it cost extra?
Not usually. Free certificates are widely available, and many hosting companies include them and renew them automatically. What matters is that someone has set it up properly and checks that it keeps renewing.
What to check on your own website
- Does the address start with https:// and show a padlock?
- Type http:// instead. Are you automatically taken to the https:// version? You should be.
- Check with and without www, such as www.yourshop.in and yourshop.in. Both should end up at the same secure address.
- Look for warnings on any page, especially pages with forms or images. A “not fully secure” warning can mean some images or files still load over plain HTTP.
- Find out when the certificate renews, and whether it renews automatically.
Common problems
- An expired certificate, which makes browsers show a full-page warning that most visitors won't click past
- A site that works on https:// but doesn't redirect from http://
- Mixed content: a secure page that still loads some images or scripts insecurely
- A certificate that covers yourshop.in but not www.yourshop.in, or the other way round
How we handle it
Every website we build uses HTTPS everywhere, with plain HTTP and www addresses redirected to one secure address. It's part of our “secure by default” standard on how we build. Our maintenance plans include SSL, security updates, backups and uptime monitoring, so renewals and checks don't depend on anyone remembering. See also backups, security updates and uptime monitoring.
In short
- HTTPS encrypts the connection between visitors and your website; an SSL certificate makes it work.
- The padlock means the connection is secure, not that the website itself is trustworthy.
- Every business site needs HTTPS everywhere, with automatic renewal and redirects from plain HTTP.
