Internet How the web works under the address bar
HTTPS and the padlock: what it proves and what it does not
What the padlock in the address bar actually guarantees, why scam sites have it too, and the certificate warnings you should never click past.
The short answer
- The padlock proves your connection to the domain shown is private and unaltered, and proves nothing about the honesty of whoever owns that domain.
- Certificates that only verify control of a domain are free and issued in seconds, which is why almost every phishing site has a padlock.
- Browsers stopped displaying company names for heavily vetted certificates because people never used them, so no visible indicator now separates the validation levels.
- HTTPS still leaks which sites you visit to the local network, through the opening handshake and through unencrypted domain lookups.
- A certificate warning usually has a dull cause such as a wrong device clock or a wifi login portal, but it looks identical to a real interception.
- Never click past a certificate warning on a page where you would sign in or pay, and never on a network you do not control.
The padlock proves one thing: your browser has a private, tamper resistant connection to the exact domain name shown in the address bar, and that domain holds a certificate a recognized authority issued to it. That is all. It says nothing about whether the people running that domain are honest, whether the shop will ship your order, or whether the name is the company you think it is. Certificates are free and issued automatically within seconds, so a criminal running a fake login page gets the same padlock your bank has, on the same day they register the domain.
What the padlock actually guarantees
HTTPS is ordinary web traffic wrapped in TLS, and TLS delivers three things.
Confidentiality. Everything after the domain name is encrypted: the page you requested, what you typed into forms, the cookies sent back, and the content returned. Someone sharing the cafe wifi, or the network operator in between, cannot read any of it.
Integrity. Content cannot be quietly altered in transit. Without HTTPS, anyone on the path can inject scripts, swap a download for a different file, or insert their own content into a page. With it, tampering breaks the cryptographic checks and the connection fails loudly instead of lying to you.
Server authentication. The site proves it holds the private key matching a certificate issued for that domain name. This is the part people misread. It authenticates a name, not a business, not an intention, and not a reputation.
How a certificate proves anything
Your browser and operating system ship with a root store: a list of certificate authorities they trust, maintained with a great deal of scrutiny. When you connect, the server presents a certificate plus the chain linking it back to one of those roots. The browser checks that the chain is valid, that the name on the certificate covers the host you asked for, that the dates are current, and that the certificate has not been revoked. Then the two sides agree on temporary session keys and the real conversation begins.
Modern setups use ephemeral keys for that agreement, which gives forward secrecy: an observer who records today's traffic and steals the server's key next year still cannot decrypt what they captured.
Certificates come in three validation levels, and the difference matters less than the marketing once suggested:
| Level | What is checked | How long it takes | What you see |
|---|---|---|---|
| Domain validated | Only that the applicant controls the domain | Seconds, fully automated | Exactly the same padlock as any other |
| Organization validated | Some vetting of the named company | Days, with paperwork | The same padlock; details buried in the certificate |
| Extended validation | Fuller checks on the legal entity | Longer, more paperwork | The same padlock; browsers stopped showing company names |
Browsers removed the green bar and the company name after concluding that people did not notice it and did not behave differently when it was absent. The practical result is that no visible browser indicator now distinguishes a heavily vetted certificate from a free automated one.
Why scam sites have padlocks too
Once certificates became free and automatic, the economics flipped. Registering a lookalike domain and pointing an automated certificate at it takes minutes, so the overwhelming majority of phishing pages are served over HTTPS. Padlock absence is now a signal, but padlock presence is not.
Browsers have adjusted accordingly. Several have demoted or removed the padlock icon, replacing it with a neutral control, precisely because people read the symbol as an endorsement of the site rather than a description of the connection. The warning that remains is the one for plain HTTP, marked as not secure.
Which makes the address bar skill the one that actually protects you. Finding the registered name before the first single slash is covered in how to read a web address properly, and the messages that steer people to lookalike domains are dissected in how phishing works.
What HTTPS still leaks
Encryption covers the contents of the conversation, not the fact that it happened. Anyone watching the network can usually still see the following.
- The domain you are visiting. The server name is normally sent in the clear during the opening handshake so the server knows which site to serve, and there are encrypted variants of this, but they are not universal.
- The lookup that preceded it. Unless you have turned on encrypted DNS, the query asking where a domain lives travels in plain text, as explained in how DNS works.
- Timing and volume. How much data moved and when is visible, which is often enough to infer what kind of activity took place.
So on shared wifi, HTTPS protects your passwords and your page contents while leaving a list of the sites you visited exposed to the network. That is the honest version of what is and is not risky on public wifi. A VPN moves that visibility rather than deleting it: the local network stops seeing your destinations and the VPN operator starts, which is the trade off examined in what a VPN can and cannot do.
HTTPS also does nothing about the site itself. The operator sees everything you send, because you sent it to them, and it does not stop the trackers embedded in the page doing their own collection of what you looked at. Nor does it protect you from a browser extension with permission to read pages, or from a managed work device where an administrator has installed their own root certificate so traffic can be inspected.
Certificate warnings and their real causes
Full page warnings are uncomfortable to read and easy to click past, which is exactly the wrong instinct. Most have dull causes, but the dull ones look identical to the dangerous one.
| What the warning says | Most likely cause | What to do |
|---|---|---|
| Certificate has expired or is not yet valid | A genuinely lapsed certificate, or your device clock being wrong | Check the date and time on your device first |
| Name does not match | A hotel or airport login portal intercepting you, or a typo in the domain | Reread the domain; accept the portal page only if you expected it |
| Issuer is not trusted | A company inspection proxy, antivirus scanning HTTPS, or a self signed certificate | Normal on a managed work laptop, suspicious on your own device |
| Revoked certificate | The authority withdrew it, sometimes after a key compromise | Do not proceed |
| Warning cannot be bypassed at all | The site has told browsers to require HTTPS permanently | Leave; the site owner has ruled out exceptions deliberately |
The rule is simple. Never click through a certificate warning on a page where you would sign in, pay or enter identity details, and never click through one on a network you do not control. If you cannot name the reason for the warning, treat it as an interception attempt.
Mixed content and HSTS
Mixed content happens when a page loaded over HTTPS pulls in pieces over plain HTTP. Browsers block the dangerous kinds outright, meaning scripts, frames and stylesheets, because those can rewrite the page. Passive items like images are often upgraded automatically or blocked. If a page looks broken with missing pictures and a nonstandard padlock, this is usually why, and it is a maintenance problem on the site rather than an attack on you.
HSTS is the site telling your browser to use HTTPS for this domain for a set period, no matter what you type. A preload list built into browsers extends that to the very first visit, which closes the window where an attacker could downgrade you to plain HTTP before any protection existed. The visible side effect is the last row of the table above: on an HSTS site, the option to proceed anyway is removed by design.
How to use this in practice
Read the domain before you read the padlock, and read it the way the browser does, right to left from the first single slash. Treat a sign-in or payment form on a page marked not secure as disqualifying, and close the tab. Never dismiss a certificate warning on public wifi or on a page handling anything sensitive. Keep your browser updated, since revocation lists and trusted root changes arrive with updates and a stale browser trusts things it should not.
And keep the mental model straight. HTTPS answers the question of whether anyone can listen to or alter this conversation. It never answers whether the other end deserves your money or your password. That second question is judged by the domain name, the route you took to get there, and what you knew about the organization before the page opened, which is the actual checklist for buying from a shop you have never heard of.
Common questions
Does the padlock mean a website is safe?
No. It means the connection to that domain is encrypted and has not been tampered with in transit. Fraudulent sites obtain the same padlock within minutes of registering a domain, because the common certificate type only verifies that the applicant controls the address. Judge the site by the domain name and by how you arrived there, not by the icon.
Why does my browser say a site is not secure?
Because the page loaded over plain HTTP, with no encryption at all. Anything you type can be read and altered by anyone on the network path between you and the server. For reading a static page it is a low risk, though the page could have been modified. For logging in or paying, it is a reason to stop.
Is it ever safe to click past a certificate warning?
Only when you can name the exact cause and it is harmless, such as a home device with a self signed certificate you set up yourself, or an obvious wifi login portal in a hotel. Never do it on a page that asks for credentials or payment details, and never on a network you do not control, because the benign and the hostile versions look identical.
Can my internet provider see what I do on HTTPS sites?
They can see which sites you connect to and roughly how much data moves, because the domain name generally appears in the opening handshake and in the lookup that precedes it. They cannot see the pages, the form contents or the passwords. Encrypted domain lookups reduce the leak, and a VPN shifts it to the VPN operator instead.
Do I still need a VPN if a site uses HTTPS?
Not for protecting what you type. HTTPS already encrypts the contents of the session on any network, including open wifi. A VPN addresses a different question, which is who gets to see the list of places you connect to, and it answers it by moving that view from the local network and your provider to the VPN company.