That small padlock next to a website address is so common now that most people stop noticing it, until it is missing. Then browsers show a warning, visitors leave and forms stop feeling safe. Here is what the padlock actually means, in plain terms.
What an SSL certificate does
The padlock shows that the connection between the visitor's browser and your website is encrypted. Anything sent along the way, such as the details someone types into your contact form or a card number on a checkout page, cannot be read or changed by anyone in between, for example on public wifi.
Technically it is called TLS today, but "SSL certificate" has stuck as the everyday name.
What it does not prove
This is the part most people get wrong. The padlock does not mean:
- that the website is trustworthy or that the business is real;
- that the site is free of malware;
- that the people behind it will look after your data properly.
Certificates are free and automatic, so scam websites have padlocks too. The padlock protects the journey of the data, not its destination.
Why your website must have one
- Browsers warn visitors on pages without a secure connection, especially where there is a form. Many people will not go further.
- Search engines prefer secure pages.
- Forms and payments need it. Sending personal details over an unencrypted connection is not acceptable today, and payment providers will not work without it.
Common problems, and how to spot them
- An expired certificate. Browsers then show a full-page warning. Certificates should renew automatically; if yours is renewed by hand, someone will eventually forget.
- Only one version of your address is secure. Check that
yourbusiness.co.uk,www.yourbusiness.co.ukand thehttp://versions all end up on the secure address. - Mixed content. The page is secure, but an image or script is loaded from an insecure address. Browsers may block it or drop the padlock.
- A certificate for the wrong name. After a domain change, the certificate may not cover the new address.
A two-minute check
- Type your address with
http://at the front and see whether it switches tohttps://. - Try it with and without
www. - Click the padlock and look at the expiry date of the certificate.
- Open your contact page and check the padlock is still there.
How we handle it
On the websites we host, certificates are issued and renewed automatically, every version of the address redirects to the secure one, and browsers are told to always use the secure connection. It is one of those things that should simply never go wrong, and it is part of what our Care Plan looks after, along with the rest of your website's security.