What the padlock says, and what it does not
The little padlock in the address bar is probably the most misunderstood security symbol on the web. It asserts exactly two things: the data exchanged between browser and server is encrypted, therefore unreadable to anyone intercepting it, and the server answering really is the one that controls this domain name.
It says nothing else. Not that the site is honest, not that the company exists, not that your data will be handled properly afterwards. A phishing site gets a free certificate in minutes, exactly like you. That is why « check for the padlock » stopped being sufficient security advice to give your customers a long time ago.
What the certificate does change for you is very concrete. Without it, browsers show a full-page warning, Google demotes you, and forms are flagged as insecure at the precise moment a visitor was about to leave you their phone number.
The three failures that cost the most
1. Expiry. A certificate has a short life, often 90 days. Renewal is normally automatic, but it breaks: a migration, a DNS change, a firewall blocking validation. The day it expires, the website becomes unreachable behind a red screen for everyone, with no warning and without anything having changed on the site itself. It is the most frequent and the most brutal failure.
2. A certificate that does not cover every variant. A certificate issued for example.com does not cover www.example.com, and the other way round. The visitor who types the uncovered variant hits the warning. The classic case: everything works from links on the site, and fails from a business card where the address is written with the www.
3. Mixed content. The page is served over HTTPS but calls an image, a script or a stylesheet over HTTP. The browser blocks the resource or downgrades the padlock. It is almost always a migration leftover: the site moved to HTTPS, and a handful of hard-coded addresses did not follow.
Should you pay for your certificate?
In the vast majority of cases, no. A free certificate issued by a recognised authority encrypts exactly as well as a paid one: the encryption level does not depend on the price. The difference lies in validating the identity of the company behind the domain, and in contractual guarantees.
Yet browsers have stopped displaying extended validation certificates differently. The green bar with the company name, which justified the spending, no longer exists in mainstream browsers. For a brochure site, a modest shop or a services website, the free certificate renewed automatically is the right choice, and it is what almost every host provides by default.
The real subject is not the price of the certificate, it is what surrounds it: a systematic redirect from HTTP to HTTPS in a single step, and the HTTP security headers that stop a browser falling back to plain text.
Check yours in two minutes
Three steps, with no tool and no server access:
- The date. Click the padlock, then the certificate details. Note the expiry date. If it falls within thirty days and you do not know who renews it, you have found your next task.
- Both variants. Type your address with the www, then without. Both must land on the same page, with no warning, and the final address must be identical in both cases.
- Mixed content. Open the browser console with F12, Console tab, and reload. A message containing « Mixed Content » names the offending resource precisely.
If you would rather not open the console, our free audit measures it from the outside and returns the result in plain language, with the fix to apply.
HSTS: the lock that stops the fallback
The certificate encrypts the connection, but it does not guarantee the visitor uses it. Someone typing your address without the protocol arrives first over HTTP, in plain text, before being redirected. That first request, however brief, travels unprotected and can be hijacked.
The Strict-Transport-Security header closes that window. It tells the browser: for this domain, never use anything but HTTPS again, for the stated duration. The browser remembers the instruction and switches on its own, without asking the server. The redirect stays for the very first visit, but every subsequent one starts encrypted.
That leaves the first visit from a browser that does not yet know your domain. The preload list handles it: by adding the preload token to the header and submitting the domain to the public list, your domain ships inside the browsers themselves. Even the first visit is protected.
⚠️ One warning, because this setting is hard to undo: preloading applies by default to all your subdomains, and getting off the list takes months. If an internal subdomain cannot speak HTTPS, it will become unreachable. Check them all before submitting, and start with a short duration that you extend once confident.
What our audit measures
The TLS and certificate category holds 6 checks: HTTPS active, presence of the HSTS header, length of the redirect chain from HTTP, absence of mixed content, DNSSEC validity and presence of a CAA record. A seventh measurement, in the domain name category, gives the number of days left before the expiry of the latest certificate issued for your domain, read from the public certificate transparency logs.
What the audit does not do: it does not judge the authority that issued the certificate, and it cannot know whether your automatic renewal works. It tells you how many days are left. Checking that something is scheduled before the deadline is on you.