What HTTPS is and what the padlock really tells you
HTTPS means the connection between your browser and a website is encrypted. Nobody along the way, like someone on the same café Wi-Fi or a compromised router, can read what's sent or quietly change it. It doesn't mean the website itself is honest, and that's the part most people get wrong.
What the S does
HTTP is the way browsers and websites have exchanged pages since the early web. HTTPS is the same thing sent through an encrypted connection, using a protocol called TLS. It does three jobs. It encrypts what you send, so passwords, card numbers and messages can't be read in transit. It stops the page from being changed on the way, so nobody in between can slip in ads or malware. And it checks that you're talking to the server that really belongs to that domain, using a certificate issued by an organisation browsers trust.
Without it, everything travels in the open. When Google announced its latest change to Chrome, its security team put the risk plainly: attackers "only need a single insecure navigation" to hijack a visit or deliver malware.
What the padlock doesn't tell you
For years browsers showed a padlock next to secure addresses, and many people read it as "this site is safe". Research Google did in 2021 found that only 11% of participants understood what the icon actually meant.
The trouble is that criminals use HTTPS too. A certificate can be had for free in minutes by anyone who owns a domain. As far back as the end of 2020, the Anti-Phishing Working Group reported that 84% of phishing sites used it. So the padlock on a fake bank login page is genuine. The connection to the fake page really is encrypted.
That's why Chrome dropped the padlock in version 117, in September 2023, and put a neutral "tune" icon in its place, which opens the site's settings. Some other browsers still show a padlock, so you'll come across both.
What tells you who you're dealing with is the address. Before you type a password or a card number, read the domain itself. yourbank.com and yourbank-secure-login.com belong to different owners, and only one of them is your bank.
You can also look at the certificate itself. In Chrome, click the icon to the left of the address, then "Connection is secure" and "Certificate is valid". You'll see which domain it was issued for, who issued it and until when. On most sites it names only the domain, not the company behind it, which is one more reason the padlock alone can't vouch for anyone.
Why your site needs it anyway
Browsers already treat plain HTTP as the exception. Since July 2018, Chrome has labelled every HTTP page "Not secure". From October 2026, with Chrome 154, it goes further: the "Always Use Secure Connections" setting is on by default, so Chrome tries HTTPS first and asks the visitor before opening a public site that doesn't support it. For someone who doesn't know your business yet, that's a warning screen standing between them and your homepage.
Most of the web has already moved. Google reports that between 95% and 99% of page loads in Chrome use HTTPS, depending on the platform. Let's Encrypt, a nonprofit that issues certificates for free, said at the end of 2025 that it was serving more than 700 million websites. When it started, only 39% of page loads on the web were encrypted.
Google also uses HTTPS as a ranking signal, though a light one. When it announced this in 2014, it said the signal affected fewer than 1% of queries. It won't lift a page on its own, but a site without it looks abandoned next to one that has it.
There's a practical side as well. Many browser features only work on secure pages: location, camera and microphone access, the service workers that let a site work offline, and HTTP/2 and HTTP/3, the newer protocols that help pages load faster. On plain HTTP, a site can't use any of them.
How to get it
Many hosting companies include a free certificate, usually from Let's Encrypt, that you can switch on from the control panel. If your site sits behind a service like Cloudflare, it can handle the certificate between your visitors and Cloudflare. The connection from Cloudflare to your own server should be encrypted too, or part of the trip still travels in the open.
You'll also see certificates for sale, including "extended validation" ones, where the issuer checks the company behind the site. The encryption is the same as with a free certificate. These used to show the company's name in a green bar next to the address, but Chrome and Firefox removed that in 2019, after Chrome's security team concluded from its own research that people didn't make safer choices because of it. For most sites, the free certificate does the job.
Once it's on, check three things. First, that http:// addresses redirect to https://, so old links and bookmarks land on the secure version. Second, that the page has no mixed content, meaning images or scripts still loaded over http://, which browsers either upgrade or block. In Chrome you'll find them by pressing F12 and opening the Console tab. Third, that the certificate renews by itself.
A developer can also turn on HSTS, a setting that tells browsers to use HTTPS for your domain from then on. After the first visit, even an address typed with http:// is never sent unencrypted.
Automatic renewal matters more every year. Certificates expire, and when one does, visitors get a full-page warning instead of your site. In 2025 the CA/Browser Forum, the group of browser makers and certificate issuers that sets the rules, agreed to shorten the maximum life of a certificate in steps: 200 days from March 2026, 100 days from March 2027 and 47 days from March 2029. Renewing by hand once a year is on its way out, and automatic renewal, which tools built around Let's Encrypt already do, is becoming the only practical option.