Guides . Websites

The Padlock: SSL and HTTPS, Explained

You have seen the little padlock next to a web address. Here is what it means, and why some sites say Not Secure.

Part of our Websites and Hosting guides.

The two doors

Padlock vs Not Secure, side by side

Same shop, same web address. The only difference is whether the lock is on the door.

http

The unlocked door

  • Information travels out in the open
  • Anyone in between can listen in
  • No ID card proving the site is yours
  • Browsers flag it as Not Secure
https

The locked door

  • Information is scrambled end to end
  • Only your shop can unscramble it
  • An ID card proves the site is really yours
  • Browsers show the padlock

The short version

The padlock is a locked front door

Think of your website like a shop on a street. The padlock is the lock on the door.

When someone visits, their name, email, and anything they type moves back and forth with your shop. Without the padlock, that talk happens out loud, and anyone in between can listen in.

With the padlock, the same talk gets scrambled so only your shop can read it. The padlock also carries a small ID card that proves the visitor reached the real you, not a fake set up down the street.

That is the whole idea. The connection is locked, and the shop is really yours.

No padlock means the talk happens out loud. The padlock means it happens sealed.

What the padlock does

How a secure visit happens

Four quick moments turn an open conversation into a sealed one.

Visitor arrives types your web address
Site shows ID certificate proves it is you
Line is sealed the padlock appears
Info stays private scrambled end to end

The words, decoded

http, https, and SSL, without the jargon

Three terms get used together a lot. Here is what each one really is.

http
The old way a browser talks to a website. It works, but everything gets sent out in the open. This is the one browsers now flag as Not Secure.
https
The same thing with the lock added. The s stands for secure. When you see it, the padlock shows and the talk is sealed.
SSL certificate
The small file that makes the lock work. It scrambles the connection and proves the site is really yours. Some people say TLS certificate. Same thing, newer name.
Not Secure warning
What a browser shows when a site is still on plain http with no certificate. It tells visitors the door is unlocked, and that makes people nervous even when nothing is wrong.

How it works with us

How we handle the padlock for you

You do not touch any of this. If your site is with us, here is what we do behind the scenes.

  1. 1

    We set up the certificate

    We get a certificate made for your site and put it on the server where your website lives. It often comes with hosting. Just ask and we will tell you what your setup needs.

  2. 2

    We switch the site to https

    We point your web address at the secure version. Then we make sure old links quietly send people to it, so no one lands on the unlocked door by accident.

  3. 3

    We check every corner

    One stray image or link still on http can knock out the padlock. We check the whole site so the lock shows on every page, then tell you when it is live.

  4. 4

    We keep it from lapsing

    Certificates run out on a set schedule. We renew yours before it does, so your site never flips to Not Secure and scares your visitors.

Straight answers

Questions clients actually ask

My site says Not Secure. Is it broken or hacked?
Almost always no. It usually just means the site is still on plain http with no certificate on it. Nothing is broken. The lock has not been added yet. We can add it.
Do I need SSL if I do not sell anything online?
Yes. Even a simple info site or a contact form should have the padlock. Visitors and Google both expect it now, and a Not Secure warning costs you trust either way.
Does the certificate cost extra?
A certificate often comes with hosting, but the exact answer depends on your setup. Tell us where your site lives and we will give you a straight answer.
What happens when the certificate expires?
If no one renews it, the padlock goes away and the browser warns every visitor. When we handle your site, we renew it early so that never happens.
Can you add the padlock if my site is hosted somewhere else?
Usually, yes. We can work with your current host. We may need permission to get into the right account. Point us at it and we will tell you what we need.

Keep reading

Related guides and next steps

The padlock is one piece of a bigger picture. Here is where the rest lives.

Want the padlock handled and never think about it again?

If this is getting confusing, or you would rather we just take care of the certificate, the switch to https, and the renewals, give us a call. We will make sure the lock shows and stays showing.

Get help with this Or call 717-299-1277

Not ready to talk yet? You may be after something so unique we have not built a page for it yet, and given our history of unexpected jobs, we are sure we will find a solution.