HTTPS and the Padlock: What It Really Tells You About a Website
The padlock means your connection is private, not that a site is trustworthy. Learn what HTTPS protects, what it does not, and how to stay safe online.
Years ago, people were taught: "Look for the padlock." That advice is only half right today. The padlock tells you something useful, but not everything.
What HTTPS does
HTTPS is the secure version of HTTP, the language browsers and websites use. The "S" stands for secure. It does two main things:
- Encrypts the data between your device and the website. Someone on the same Wi-Fi cannot read your passwords or messages in transit.
- Verifies the website's identity with a digital certificate, which says that this server really controls this domain name.
Think of it like a sealed envelope that only the intended receiver can open.
What HTTPS does not do
- It does not mean the website is honest. Scam and phishing websites can get certificates too. A fake bank site can show a padlock.
- It does not protect you if you download a harmful file or give your details to a fraudster.
- It does not protect the data after it arrives. The website still stores or uses your data as it wishes.
5 checks that matter more than the padlock
Read the address carefully
Look for spelling tricks such as `paypa1.com` (with a number one) or `bank-secure-login.example.net`.
Be careful with links in messages
Type the website name yourself or use a bookmark instead of tapping links from SMS or email.
Check the full domain
In `login.example.com.scam-site.net`, the real domain is `scam-site.net`, the part just before the final ending.
Look at the context
Is it asking for OTP, PIN, or card details in a way that feels rushed? Slow down.
Keep your browser updated
Browsers warn about dangerous sites using regularly updated lists.
Why almost every site uses HTTPS now
Browsers now warn about websites without HTTPS, and free certificate services have made it easy for site owners to secure their sites. As a result, most of the web is encrypted today.
What most people miss
- Public Wi-Fi is safer than before, because of HTTPS, but fake Wi-Fi hotspots can still trick you into connecting. Avoid banking on unknown networks.
- A certificate warning is serious. If your browser says the connection is not private, do not click through for sites where you enter passwords.
