Most people notice HTTPS by its absence — a "Not Secure" warning in the address bar, right before a customer clicks away. It's one of the least glamorous three letters in web development, and also one of the few that shows up directly in front of your customers, not buried in code they'll never see.
A lot of business owners assume it's something their host just handles automatically, or worse, something only "real" companies need. Neither is fully true. Whether HTTPS is set up correctly is one of a handful of things that quietly decides whether a visitor trusts your site enough to actually buy something.
Here's what it actually protects, what it doesn't, and why it's not the upsell some quotes make it out to be.
What HTTPS Actually Protects
The padlock, in plain terms
HTTPS encrypts the connection between your visitor's browser and your server. Anything typed into a form on your site — a phone number, a delivery address, payment details — travels scrambled, not as plain readable text. Without it, that same information can, in theory, be read by anyone sharing the same network as your visitor: a public wifi at a mall, a shared office router, a café.
Why browsers make it so visible
Chrome and other major browsers now flag any non-HTTPS site with a "Not Secure" warning right in the address bar — not hidden in a settings menu somewhere, front and center before anyone reads a word of your page. For an online store or a contact form asking for a phone number, that warning alone is often enough to make a visitor leave before they see anything else.
What It Doesn't Do
HTTPS isn't a stamp of legitimacy on its own — a scam site can have the same padlock, since free certificates are available to literally anyone with a domain. It also won't protect you from a weak admin password, an outdated plugin, or a phishing email that tricks someone into handing over a login.
HTTPS protects the road between your visitor and your server. It says nothing about what's waiting at the destination.
It's one layer, not the whole fence — worth knowing, especially if a quote is treating it as if it covers everything.
How I Actually Handle This
Every site I build ships with HTTPS from day one, using a free certificate that renews itself automatically — there's no real reason it should ever be a paid add-on or something quoted separately, and if someone's charging extra for it, that's worth asking about. The one thing I do check manually, on any site I take over or maintain, is that the renewal is actually automated and not something that quietly lapses a year later without anyone noticing.
The Quick Way to Check Your Own Site
Look at your own site's address bar right now. Padlock, or warning? That's it — the whole thing is invisible when it's working, which is exactly the point. If it's not there, it's usually a quick fix, not a rebuild.
If you're not sure whether your current site has this handled, let's talk — it's one of the first things I check.
Further reading
- 3 Quiet Habits Behind Every Reliable Website — czerwin.net
- 3 Things You Should Actually Own on Your Own Website — czerwin.net