HTTPS and the padlock: why it matters for your site

HTTPS is the locked version of a web address. It scrambles what passes between your customer's phone and your website, so nobody in between can read or change it. Without it, Chrome, Safari and other browsers label your site "Not secure", which is the last thing you want a customer to see before they type their name and number into your contact form. The good news: for almost every small business, HTTPS costs nothing extra today, and turning it on is a setting, not a project.

What HTTPS and the padlock actually are

Every website address starts with either http:// or https://. The extra "s" stands for secure. When a site uses HTTPS, the browser and the site agree on a private way of talking before anything is sent. A message typed into your contact form travels scrambled, and only your website can unscramble it.

To do this, your site needs a certificate. Think of it as an ID card for your web address, issued by a trusted company called a certificate authority. The browser checks the card every time someone visits. If the card is valid and matches the address, the browser shows the site normally, often with a small padlock or a settings icon next to the address. If the card is missing, expired or belongs to a different address, the browser warns the visitor.

You will also hear the older name SSL. SSL certificates and TLS certificates are the same thing for your purposes. "SSL" stuck as the everyday word.

What your customers see when it is missing

A site without HTTPS still opens. But the browser makes its doubts visible:

"Not secure" appears next to the address in Chrome, and similar labels in other browsers.
On a form page, some browsers add a stronger warning when someone starts typing into a field.
An expired or mismatched certificate is worse. Instead of a small label, the visitor gets a full-page warning such as "Your connection is not private", with a big button to go back. Most people take it.

For a plumber, a dentist or a bakery, the risk is not that someone steals data from the contact form. It is that a customer who was ready to call sees a warning and decides to call someone else. People rarely know what HTTPS is. They do know what "not secure" means.

Does Google care?

Yes, a little. Google has said for years that HTTPS is a small signal in how it ranks pages, and Chrome is a Google product, so the "Not secure" label comes from the same company. Do not expect HTTPS alone to move you up. Nobody can promise a ranking because of one setting. Treat it as something Google expects of every site, the way it expects a working phone layout.

The bigger Google issue is a broken switch. If your site moves from http:// to https:// and the old addresses do not forward to the new ones, Google can end up with two copies of every page, or with links that lead nowhere. Done properly, the old addresses send visitors and Google to the HTTPS version automatically.

Where certificates come from, and what they cost

Ten years ago, certificates were sold for yearly fees and installed by hand. That is mostly history.

Website builders such as Squarespace, Wix, Shopify and most others include a certificate on every site and renew it automatically.
Most hosting companies offer free certificates, often from Let's Encrypt, a non-profit certificate authority. In the control panel it may be called "SSL", "Let's Encrypt" or "AutoSSL". It usually needs one switch turned on.
Services that sit in front of your site, such as Cloudflare, can provide the certificate too.

Paid certificates still exist. Some show the company's verified name in the certificate details, and some come with insurance or support. A small business with a brochure site and a contact form does not need one. If your host is pushing a paid certificate as the only option, ask whether a free one is available, and read whether you need to buy an SSL certificate before you pay.

How to check your own site in two minutes

Type your address without the "s". Open a browser and type http://yourbusiness.com. You should land on https://yourbusiness.com automatically. If you stay on the http address, the forwarding is missing.
Try it with and without "www". Type http://www.yourbusiness.com too. All four versions should end on the same HTTPS address. With or without www explains why that matters.
Click the icon next to the address. The browser shows whether the connection is secure and, under certificate details, who issued it and when it expires.
Check on your phone. Some problems only show on one browser. Open the site on your own phone in Safari or Chrome.
Look at the contact page. If that page has a "Not secure" label while the home page does not, part of the site is still loading over plain HTTP.

The usual problems and what to do about each

The certificate expired. Free certificates renew automatically, but only while the setting stays on and the domain still points to the same host. A domain moved to a new host without moving the certificate setup is the classic cause. Your host's support can usually reissue it in minutes.

"Mixed content". The page is HTTPS, but a photo, a script or a font on it still loads from an http:// address. Browsers may then show the page as only partly secure or block the item. Old sites often have image links hard-coded with http://. The fix is to change those links to https://, or use a plugin or setting that does it.

The certificate is for the wrong name. A certificate for yourbusiness.com may not cover www.yourbusiness.com. If one version shows a full-page warning, the certificate needs both names.

No forwarding from HTTP to HTTPS. The certificate works, but people who type the old address stay on the unprotected version. Most hosts have a "force HTTPS" switch. Builders do this for you.

When the padlock is a sign of bigger trouble

A missing certificate on an old site is often a symptom. If your site was set up years ago by someone who is no longer around, nobody may be watching the renewals, the software updates or the backups either. Sites in that state are the ones that get hacked and fill with spam pages. If you see warnings other than "Not secure", such as Google's red "Deceptive site ahead" page, read website security and Google warnings first.

What to do this week

Type all four versions of your address (with and without "www", with and without "s") and confirm each one ends on the same HTTPS page.
Click the icon next to your address and note when the certificate expires.
Open your contact page on your phone and make sure there is no "Not secure" label.
If anything fails, find out who controls your hosting or builder account and switch on the free certificate there.

If your site is old enough that nobody can find the login, it may be simpler to see your site rebuilt first, with HTTPS set up from the start.