How to Check if a Website Is Using HTTPS Correctly

The padlock icon in your browser's address bar has become something of a security symbol over the years, and for most people it signals that a website is safe to use. That reading is not entirely wrong, but it is not entirely right either. HTTPS does something specific and limited, and understanding what it actually does, rather than what we assume it does, will change how you evaluate websites going forward.

What HTTPS Actually Does

HTTPS stands for Hypertext Transfer Protocol Secure. The "secure" part refers to encryption applied to the connection between your browser and the web server. When you load a page over HTTPS, the data travelling back and forth is encrypted in transit. Anyone sitting between you and the server, such as someone on the same coffee shop Wi-Fi, your internet service provider, or an operator running a packet sniffer on a public network, cannot read the content of that traffic without breaking the encryption.

That is genuinely useful. It means your passwords, credit card numbers, and messages are not being transmitted in plain text across a network you may not control. Before HTTPS became widespread, logging into websites on public Wi-Fi was a legitimate risk. It is less of one now.

What HTTPS does not do is tell you anything about whether the website itself is honest, competent, or even who it says it is at a basic level. A phishing site impersonating your bank can have a valid HTTPS certificate. A scam shop selling counterfeit goods can have a padlock. The encryption is real; the site is still dangerous. The certificate says the connection is encrypted, not that the destination is trustworthy.

How to Read a Certificate Properly

Most people never look past the padlock, which is understandable but leaves a lot of information on the table. If you click the padlock icon in Chrome, Firefox, or Edge, you will see a small panel with connection information. From there, you can access the full certificate details.

The things worth checking are: who issued the certificate, what domain or domains it covers, and when it expires. Certificates are issued by organisations called Certificate Authorities (CAs). Well-known CAs include DigiCert, Let's Encrypt, Sectigo, and GlobalSign. Let's Encrypt issues free certificates automatically, and there is nothing wrong with that, but it does mean a site having an HTTPS certificate costs nothing and requires almost no verification. Anyone can get one in minutes.

Look at the domain the certificate is issued for. A certificate for paypa1.com (note the number 1 instead of the letter l) will show a padlock even though that is clearly not PayPal. Check that the domain in the certificate matches the domain you intended to visit. Also check the expiry date. An expired certificate is a sign that nobody is actively maintaining the site, though browsers will usually warn you before you get this far.

Extended Validation (EV) certificates used to show the company name in the address bar, which gave a stronger signal of legitimacy. Browsers have largely removed that visual indicator over the last few years, so EV certificates are less visible than they once were. Domain Validated (DV) certificates, which is what most sites have, only confirm that the applicant controls the domain, not who that applicant is.

Mixed Content Warnings and What They Mean

A page can load over HTTPS but still pull in resources such as images, scripts, or stylesheets over plain HTTP. When that happens, you have what is called a mixed content situation. The main page is encrypted, but parts of it are not, which undermines some of the protection.

Modern browsers handle this in two ways. Passive mixed content, such as images loaded over HTTP, may still display but the browser will typically warn you. Active mixed content, such as scripts or iframes loaded over HTTP, is usually blocked outright because it could allow an attacker to inject malicious code into an otherwise secure page.

If your browser shows a warning about mixed content, or if the padlock has a caution symbol on it rather than a clean closed padlock, that is worth paying attention to. It does not necessarily mean the site is malicious, but it does mean the site's developers have not implemented HTTPS consistently.

HTTP Strict Transport Security

HTTP Strict Transport Security, usually shortened to HSTS, is a mechanism that tells your browser to always use HTTPS when connecting to a particular domain, and to refuse to fall back to plain HTTP even if something instructs it to. Once a site sends an HSTS header and your browser has seen it, your browser will not load that site over plain HTTP for the duration of the policy, which is typically set to a year or more.

This matters because one of the classic attacks against HTTPS is a downgrade attack, where an adversary intercepts your connection before you reach the HTTPS site and redirects you to a plain HTTP version instead. HSTS defeats this for sites you have visited before. There is also an HSTS preload list, maintained by browser vendors, that includes major sites from the first visit rather than waiting for you to have seen an HSTS header before.

You can check whether a site uses HSTS by looking at the response headers in your browser's developer tools (press F12, go to the Network tab, reload the page, and click the first request). A header called Strict-Transport-Security with a max-age value means HSTS is active. This is a good sign that the site's operators take transport security seriously.

What "Your Connection Is Not Private" Actually Means

This error, which appears in slightly different forms across browsers, means the browser could not validate the site's certificate. There are several reasons this can happen, and not all of them mean the site is dangerous. Understanding which situation you are in matters.

The most common reason on legitimate sites is an expired certificate. The certificate was valid but the site owner forgot to renew it, or their renewal process broke. This is an operational mistake, not an attack. If the site is one you trust and use regularly, the error may be genuine negligence rather than malice. That said, on a site you do not know, an expired certificate is a reason to leave.

A self-signed certificate is another common cause. These are certificates not issued by a recognised CA, so your browser does not trust them by default. They are common on internal corporate tools and development environments. On a public-facing website you do not recognise, treat this as a significant warning.

The genuinely alarming case is a certificate that is valid but issued for the wrong domain, or one that has been flagged by your browser's malware detection. In those cases, leave immediately.

A practical check you can do right now: open any website you regularly use for sensitive activities, such as your bank, your email provider, or a shopping site where you have saved payment details. Click the padlock, open the certificate details, and verify the issuer, the domain the certificate covers, and the expiry date. It takes about ninety seconds and gives you a much clearer picture of what your browser is actually trusting. You can also visit a site like the SSL Labs server test by searching for it, which will give you a detailed breakdown of a site's HTTPS configuration including whether HSTS is set and which cipher suites are supported. Doing this for a few sites you use regularly is a reasonable baseline check.

For more on how to evaluate the security of tools you use regularly, see our overview at security. If you are thinking about how browser behaviour affects your everyday safety, the piece on what browser extensions are safe to keep covers some related ground. And if you are setting up better account security to go alongside safe browsing habits, setting up a password manager safely is the logical next step.