HTTPS vs HTTP: What the Padlock Really Tells You
Years ago, people were told to look for the padlock icon before entering any information on a website. That advice is still partly useful, but it is also misunderstood. Today most websites, including many fake ones, use HTTPS. To stay safe, you need to know exactly what the padlock means.
What HTTP and HTTPS mean
HTTP stands for Hypertext Transfer Protocol, the basic set of rules browsers use to request web pages. HTTPS is the secure version, where the “S” stands for secure. With HTTPS, the data travelling between your device and the website is encrypted, which means other people on the network cannot easily read it or change it on the way.
Why encryption matters
Imagine using the wifi at a cafe. On a plain HTTP page, someone else on that network could potentially see what you send, including form data. With HTTPS, they only see that you are connecting to a website, not what you are sending. It also protects the page from being altered in transit, for instance by injected ads or malicious code.
How a website gets HTTPS
A website owner obtains a digital certificate from a certificate authority. The certificate proves that the connection is set up for that particular domain name. Many hosting companies now provide certificates for free, which is why HTTPS has become so common.
What the padlock does not mean
- It does not mean the site is legitimate. A scammer can get a certificate for a fake website just as easily as an honest owner can.
- It does not mean the content is safe. Files you download from an HTTPS page can still contain harmful software.
- It does not guarantee privacy from the site itself. The website you visit can still collect the information you give it.
So the padlock answers one question: “Is my connection to this domain encrypted?” It does not answer “Should I trust this domain?”
What browsers show today
Modern browsers focus on warning you when a site is not secure, instead of praising the ones that are. If you see a “Not secure” label, or a full-page warning about a certificate, take it seriously. Do not enter passwords or card details on that page. A warning screen usually means the certificate has expired, does not match the domain, or cannot be verified.
How to check a site properly
- Read the domain name carefully, as explained in our phishing guide.
- Look for HTTPS, but treat it as the minimum, not the proof.
- Check for real contact details, a clear privacy policy, and a business that exists outside the website.
- Search for the site’s name together with words like “reviews” or “scam”.
- For payments, prefer well-known methods that offer buyer protection.
For website owners
If you run a website, use HTTPS on every page, not only the login. Redirect old HTTP addresses to the secure version, and renew your certificate before it expires. It protects your visitors, and browsers will warn people away from sites that do not use it.
Summary
HTTPS is an important basic protection, and every website that handles any data should use it. But it only secures the road between you and the website. Whether the destination is honest is a separate question that you answer with careful reading and common sense.
