Fazley RabbiHTTPS means the connection between a visitor's browser and your website is encrypted, so anyone in between, such as someone on the same public Wi-Fi, cannot read or quietly change what is sent. An SSL certificate (strictly speaking, a TLS certificate today) is the small file on your server that makes this possible and proves the server belongs to your domain name. The padlock is the browser's way of saying both are in place. It does not mean the business behind the site is honest, and that difference matters.
What HTTPS actually does
Think of a sealed envelope instead of a postcard. HTTPS gives three protections:
- Privacy: what a visitor types, such as a phone number in an order form or a password, travels in encrypted form.
- Integrity: nobody along the way can insert ads, scripts or fake content into your pages.
- Identity: the certificate shows the browser that it is talking to the real server for your domain, not an impostor.
Without HTTPS, major browsers label a page "Not secure". For a shop that asks for an address and phone number, that warning alone can make people close the tab.
What the padlock does not mean
This is the part many people misunderstand. The padlock says the connection is private. It does not say:
- that the business is real or trustworthy (scam sites can get certificates as easily as anyone),
- that the site is free of malware or has not been hacked,
- that payments on the site are handled safely.
So when you shop online yourself, still check the domain name carefully. And as a site owner, treat HTTPS as the starting point of security, not the whole of it. Website security basics covers the rest: updates, strong logins and backups.
SSL, TLS and the types of certificate
SSL was the original name of the technology. Its successor is called TLS, but "SSL certificate" stuck as the everyday term, and in practice people mean the same thing.
Certificates differ mainly in how much the issuer checks before issuing one:
| Type | What is checked | Typical use |
|---|---|---|
| Domain validated (DV) | That you control the domain | Most business websites and online shops |
| Organisation validated (OV) | The domain, plus basic details of the organisation | Companies that want their organisation named in the certificate |
| Extended validation (EV) | A stricter check of the organisation | Some banks and large firms |
Most browsers today show the same padlock for all three, so for a typical small business a domain-validated certificate is enough. Free certificates from non-profit certificate authorities are widely used, and many hosting providers install and renew them automatically. Paid certificates mainly make sense when you need organisation validation or a particular support arrangement. Check what your host already includes before buying anything.
Common problems on business websites
The certificate has expired
Certificates have an end date and must be renewed. If automatic renewal fails, visitors see a full-page warning and most will leave. Someone should be responsible for noticing; it belongs in any maintenance and backup plan.
The padlock is missing on some pages
This is usually "mixed content": the page loads over HTTPS, but an image, script or font on it still loads over plain HTTP. Browsers may block those files or drop the padlock. The fix is to update the old links to HTTPS.
Both versions are still open
If the http:// address still works without sending visitors on to https://, people and search engines see two copies of your site. Set a permanent redirect so every address leads to the HTTPS version, with and without "www".
The certificate does not match the name
A certificate issued for one name, such as the "www" version, may not cover the plain domain or a subdomain unless it was issued for them too. The browser then shows a warning.
Common questions
Does HTTPS help with Google? Google has said it uses HTTPS as a ranking signal, though a light one. The bigger effect is trust: visitors stay on a site that does not show warnings.
My site takes no payments. Do I still need it? Yes. Contact forms, logins and even plain pages benefit from privacy and integrity, and browsers warn about plain HTTP pages regardless.
Will HTTPS slow my site down? On modern hosting the extra work is small, and several modern browser features that help pages load faster only work over HTTPS.
Does the certificate make card or bKash payments on my site safe? HTTPS is required, but payment safety depends on using a licensed payment gateway properly; see taking online payments on your website.
A five-minute check you can do today
- Type your address with http:// in front and confirm it moves to https://.
- Click the padlock and look at the certificate's expiry date.
- Open a few inner pages, including forms, and look for a missing padlock.
- Ask your developer or host who is responsible for renewal, and how you will hear if it fails.
For how domains, hosting, SSL and DNS fit together, read domain, hosting, SSL and DNS explained.