VerigrityVERIGRITY GUIDE
What Is HTTPS? What the Padlock Really Means
Almost every modern website uses HTTPS, and almost every browser shows a padlock icon when it does. But the padlock is widely misunderstood. Here's what HTTPS actually protects, what it does not prove, and how to read it as one signal among many.
HTTPS in one sentence
HTTPS is the encrypted version of HTTP, the protocol your browser uses to request and receive web pages. The "S" stands for "Secure," and it means the connection between your browser and the website's server is encrypted using a protocol called TLS (Transport Layer Security).
Before HTTPS became standard, traffic between browsers and websites traveled in plain text. Anyone sitting between you and the server — a coffee shop Wi-Fi operator, an ISP, an attacker on the same network — could read or modify the content of every page you loaded. HTTPS was designed to close that gap.
What HTTPS protects
HTTPS provides three distinct guarantees:
- Confidentiality. The content of the request and response is encrypted. An observer can see that you connected to a domain and how much data was exchanged, but not the content of the pages or forms.
- Integrity. An attacker cannot silently modify the data in transit. If they try, the browser detects the tampering and rejects the connection.
- Authentication of the server. The website presents a certificate issued by a trusted authority, which proves the server controls the domain you're visiting. This is what prevents a simple man-in-the-middle attack where an attacker serves you a fake version of a real site.
What HTTPS does not protect
This is where the padlock is widely misunderstood. HTTPS does not:
- Prove the site is honest. A scam website can obtain a valid certificate for its own domain in minutes, at no cost. Almost every phishing site today uses HTTPS, and the padlock still shows.
- Prove the business is real. The certificate only confirms who controls the domain, not who operates the company behind it.
- Protect against malware you download yourself. If a site serves you a malicious file, HTTPS will encrypt the download — it doesn't scan the file.
- Hide which site you visited from your network or ISP. An observer can see that you connected to
example.comeven though the page content is encrypted. Some newer protocols like Encrypted Client Hello partially address this. - Protect you from a compromised legitimate site. If a real business's website is hacked, the attacker inherits the real HTTPS certificate.
Why the padlock was never meant to be a trust score
When browsers first started showing the padlock, the idea was to help users identify when a connection was secure enough to enter a password or card number. The padlock was always a signal about the connection, not about the website.
Over time, "HTTPS everywhere" campaigns encouraged every site — including malicious ones — to adopt HTTPS, because an unencrypted site is worse than an encrypted one even if it's operated by a scammer. This is a net good for the web, but it means the padlock alone tells you almost nothing about whether to trust a site.
In fact, browsers have moved toward removing the padlock icon for ordinary HTTPS sites, keeping warnings only for the two cases that matter: HTTP (unencrypted) and broken HTTPS (expired or mismatched certificate). The presence of the padlock is now the baseline; its absence is the signal.
What a certificate actually tells you
When you visit an HTTPS site, the server presents a certificate. That certificate includes:
- The domain name it was issued to.
- The issuing authority (Let's Encrypt, DigiCert, Sectigo, Cloudflare, etc.).
- A validity window — a "not before" and "not after" date.
- A public key used to establish the encrypted session.
Your browser verifies that the certificate's signature chains up to a trusted root authority, that the domain matches what you typed, and that the current date is inside the validity window. If any check fails, the browser shows a warning page.
You can inspect a certificate yourself by clicking the padlock (in most browsers) and choosing "Certificate" or "Connection is secure." The details vary, but every browser exposes: subject, issuer, validity dates, and the certificate chain.
How to use HTTPS as one signal among many
Because HTTPS is now the baseline, it's more useful as a disqualifier than as an endorsement:
- Absence of HTTPS is a red flag. A modern site that asks for any information — even an email address for a newsletter — should use HTTPS. If it doesn't, that's worth attention.
- Presence of HTTPS is neutral. It means the connection is encrypted. It doesn't mean the site is safe or honest.
- Broken HTTPS is a strong warning. If your browser shows a full-screen warning about the certificate, don't proceed to enter credentials or payment details. Go back and verify the site another way.
Combine HTTPS with:
- Domain inspection — is the domain spelled correctly, with no look-alike substitutions?
- Policy pages — does the site publish readable terms, privacy, and contact information?
- Independent reputation — do other sources describe the business accurately?
- Payment verification — do you recognize the payment processor and the recipient account?
Frequently asked questions
Does HTTPS mean a website is safe?
No. HTTPS means the connection is encrypted and the certificate is valid. It does not mean the site is honest, that the business is real, or that the products exist.
Why do phishing sites have HTTPS?
Because HTTPS is free, automated, and available to anyone. Modern phishing kits provision certificates in seconds. The padlock cannot distinguish a legitimate site from an imposter.
What should I do if my browser shows a certificate warning?
Stop. Don't enter credentials, payment details, or personal information. Go back, verify the correct domain from a trusted source (like the company's official app or a search result you trust), and try again. If the warning persists, do not use the site.
Is HTTP ever okay?
For public, read-only content that carries no login and no personal data — very rare today. For anything involving credentials, payments, or personal information, HTTP is not acceptable.
How can I check a site's HTTPS and certificate?
Use the Verigrity HTTPS Checker or TLS Certificate Checker. They fetch the certificate the server presents and display the subject, issuer, validity window, and whether the browser would trust it.