Short answer: A website is only genuinely secure when three things line up at once. It uses HTTPS with a valid SSL/TLS certificate that has not expired. The padlock icon in the browser confirms that the connection is encrypted, not that the business behind it is trustworthy. And the site itself takes care of the basics behind the scenes: current server software, protected login areas, and a privacy setup that respects your data. The padlock alone is a starting point, not a verdict.
In 2026, more than 95 percent of pages loaded in Google Chrome are served over HTTPS, and every browser now flags plain HTTP pages as “Not Secure” in the address bar. That shift changed the meaning of the padlock. It used to be a rare quality signal. Today it is the baseline. Which is exactly why scam sites have it too: free certificates from Let’s Encrypt take about 90 seconds to issue, and fraud researchers at the Anti-Phishing Working Group have reported that roughly 80 to 85 percent of phishing pages now sit behind HTTPS. If you were taught to “look for the padlock,” that lesson needs updating.
What HTTPS actually does (and what it does not do)
HTTPS is HTTP wrapped in an encrypted tunnel. When you load https://example.com, your browser and the server perform a TLS handshake, agree on encryption keys, and from that point on every request and response is scrambled. Someone sitting on the same coffee shop Wi-Fi cannot read your password, your card number, or the contents of the page. Neither can your internet provider. That is the promise, and TLS delivers on it.
What HTTPS does not promise is that the business at the other end is honest. The certificate proves that whoever controls the domain also controls a matching cryptographic key. It does not prove that the shop will ship your parcel, that the reviews are real, or that the person behind the site is who they claim to be. Confusing “encrypted” with “safe” is the single most exploited misunderstanding in modern online fraud.
If you want to sanity-check a site before you enter anything, a directory like webwiki.com that shows the site’s reputation, category, and user reviews is a better second opinion than the padlock alone.
SSL, TLS, and the certificate tiers
The terms “SSL” and “TLS” get used interchangeably, and that is fine in everyday speech. Technically, SSL is the old protocol (SSL 2.0 and 3.0 are both retired and known to be broken). TLS is the current one. Most modern sites run TLS 1.2 or TLS 1.3, and the certificates they use are still commonly called “SSL certificates” out of habit. When a page says it uses an “SSL certificate,” it almost always means TLS.
Certificates come in three validation levels, and this is where trust actually varies:
Domain Validated (DV) is the cheapest and fastest. The issuer only checks that the requester controls the domain, usually by DNS or email. That is what Let’s Encrypt provides for free. A brand-new fraudulent site can hold a DV certificate before its first breakfast. The padlock will look identical to any other.
Organization Validated (OV) adds a check that the company legally exists and matches the domain owner. It costs money and takes days to issue. Browsers show the same padlock, but the certificate details (click the padlock and view “Connection is secure” then “Certificate is valid”) will show the legal entity name.
Extended Validation (EV) is the strictest. The issuer does a formal legal check on the organization. EV certificates used to give the browser bar a distinctive green company name; browsers dropped that visual treatment in 2019 because studies found users ignored it. EV still exists and still costs the most, but it is now visible only inside the certificate details.
The practical takeaway: two padlocks can look identical while the businesses behind them differ by orders of magnitude in verification. If a site handles serious money, open the certificate and read who it was issued to.
The padlock myth, in numbers
Three data points that reshape how you should read the padlock:
First, Google’s Chrome transparency report shows HTTPS usage on Windows sitting between 95 and 98 percent of page loads across 2025 and 2026. The padlock is now the default, not a badge of honor.
Second, phishing telemetry from the APWG and independent researchers such as PhishLabs has consistently found that a large majority of phishing pages, often cited around 80 to 85 percent, use HTTPS. That figure rose sharply once Let’s Encrypt made certificates free in 2016 and has stayed high ever since.
Third, the average lifetime of a phishing domain is under two weeks. Attackers register a look-alike domain, get a free certificate within minutes, and burn the whole setup before the abuse reports catch up. The padlock validates the tunnel, not the intent.
How to actually inspect a website’s security
The padlock is step one, not the whole check. Here is a fast routine that takes under two minutes.
Open the certificate. Click the padlock, choose “Connection is secure,” then “Certificate is valid.” Read three things: who it was issued to, who issued it, and the expiration date. If it was issued to “the domain only” (typical for DV), that is normal for small sites but not reassuring for a shop asking for your card. If the issuer is unfamiliar, cross-check the name; the major CAs are DigiCert, Sectigo, GlobalSign, GoDaddy, Let’s Encrypt, ZeroSSL, Google Trust Services, and a handful of others. A certificate expiring in the next few days on a supposedly professional site is a red flag.
Check the domain, not just the padlock. Look at the exact spelling of the domain in the address bar. Typosquat domains like paypa1.com or micros0ft.com can carry perfectly valid certificates. If the padlock is present but the domain looks off by one character, close the tab.
Run the site through a public scanner. Free tools like SSL Labs’ server test (from Qualys) grade a site’s TLS setup from A+ to F, catch expired chains, and flag weak ciphers. For a full site-safety view, Google Safe Browsing status is checked automatically by Chrome, Firefox, and Safari; you do not need to visit a separate tool for that.
Look up the site’s reputation. Type the domain into a directory such as webwiki.com to see its category, visitor stats, and user reviews. A brand-new site with zero external footprint is not necessarily a scam, but it deserves more caution than an established brand.
Sanity-check the business. Look for a real imprint, a physical address, a working phone number, and independent reviews. This is the layer HTTPS cannot cover for you, and it is where most modern scams get caught.
Beyond the padlock: what makes a website actually secure
For the site owner, “secure” is a much bigger surface than the certificate. A responsibly-run site in 2026 layers several things behind the scenes:
Modern TLS configuration. TLS 1.2 or 1.3 only, with strong ciphers. Older protocols like TLS 1.0 and 1.1 were deprecated by all major browsers by 2020 and should not be enabled.
HSTS (HTTP Strict Transport Security). A header that tells your browser to only ever load the site over HTTPS, even if you type http://. This prevents downgrade attacks on public Wi-Fi.
A locked-down admin area. Two-factor authentication on staff logins, rate-limited login attempts, and a firewall in front of the site. Content management systems like WordPress are attacked constantly; the padlock says nothing about whether the admin dashboard is holding up.
A privacy setup that respects you. A cookie banner that actually gives you a real “reject all” option, a privacy policy that names what data is collected and why, and no tracking loaded before you consent (the GDPR standard in the EU). For a full breakdown of what to look for, our guide on the most common online scams in 2026 covers the shopping and payment side in depth.
Red flags the padlock will not catch
Situations where HTTPS is present but you should still hesitate:
The certificate was issued a few days ago and the site is asking for a large payment. Brand-new certificates on brand-new shops are the exact fingerprint of a burn-and-flip scam.
The certificate is issued to the domain only, and the domain itself is a slight misspelling of a well-known brand. This is the classic phishing setup.
The site loads over HTTPS but the checkout page redirects to a different domain, often a payment processor no one has heard of. Legitimate stripe.com, adyen.com, or PayPal redirects are normal; unrecognized domains are not.
The browser shows a warning like “Your connection is not private” or “Certificate has expired” and the site tells you to click through anyway. Never do this on a site handling personal or financial data.
Mixed content warnings (a small yellow shield or the padlock replaced with an info icon). This means some parts of the page loaded over unencrypted HTTP, which weakens the guarantee.
For a broader checklist that covers reputation, reviews, and payment safety, see our full guide on how to tell if a website is trustworthy.
FAQ
Does the padlock mean the website is safe?
No. It means the connection between you and the site is encrypted. It says nothing about who is running the site or whether they intend to deliver what they promise. Roughly 80 percent of phishing pages now use HTTPS.
What is the difference between SSL and TLS?
SSL is the older, retired version of the protocol. TLS is the current version, running as TLS 1.2 or TLS 1.3 on modern sites. “SSL certificate” and “TLS certificate” mean the same thing in practice.
Can a scam site have a valid SSL certificate?
Yes, and most do. Free certificate providers like Let’s Encrypt issue Domain Validated certificates within minutes without checking who the buyer is. The certificate proves domain control, not business honesty.
How do I know if a certificate is real?
Click the padlock, choose “Connection is secure,” then “Certificate is valid.” Read the “Issued to” and “Issued by” fields and the expiration date. If the issuer is an unknown CA or the certificate expires within days, treat that as a warning.
What if a browser warns me the site is not secure?
Do not enter passwords, card numbers, or personal data. The warning means either the site does not use HTTPS at all, the certificate has expired, or the certificate does not match the domain. Any of these is a stop signal for anything sensitive.
Is HTTPS enough on a public Wi-Fi network?
HTTPS protects the content of your traffic even on public Wi-Fi. But it does not hide which sites you visit, and it does not protect you if you type your data into a fake site. A VPN adds a layer for the first concern, but neither VPNs nor HTTPS help against a convincing phishing site.
Why did browsers drop the green EV name in the address bar?
Chrome and Firefox removed the visible EV treatment in 2019 after research showed users largely ignored it and could not tell EV from DV in tests. EV certificates still exist and can be inspected in the certificate details, but they no longer show up as a visual badge.
Sources and further reading
Google Transparency Report on HTTPS usage across Chrome (2025 to 2026 data). Anti-Phishing Working Group (APWG) quarterly phishing activity trend reports. Qualys SSL Labs server test methodology and grading. Mozilla’s server-side TLS configuration recommendations. Chromium security blog on the 2019 removal of EV certificate UI. Let’s Encrypt annual report on certificate issuance volume.
Read next: Is StubHub Legit? Full Review, Ratings and Safety Check (2026). A closer look at is stubhub legit.