HTTPS and the Padlock: What It Proves and What It Doesn't

Section 5C moves from your devices to the connections they use. We start with the most familiar security sign on the web: the "https" at the start of an address and the small icon beside it. Knowing exactly what it promises, and what it does not, is one of the most useful judgment calls you can learn.

What you'll be able to do

Explain what HTTPS protects, what it does not prove, and how to decide whether a site is genuine. By the end of this lesson you will be able to:

• explain in plain words what an encrypted connection protects;
• explain why a scam site can have HTTPS too, and why browsers changed the padlock icon;
• respond correctly to a certificate warning and use reliable checks to decide whether a site is real.

What HTTPS Does

When your browser talks to a website, it uses a set of rules called HTTP. HTTPS is the secure version: the "S" means the conversation between your browser and the site is encrypted, scrambled so that people on the network in between, such as others on the same Wi-Fi or anyone handling the traffic along the way, cannot read or quietly change it.

To set up that encrypted connection, the site presents a certificate, a kind of digital ID card. It lets your browser check that it really is connected to the web address shown in the address bar, not to an impostor sitting in the middle.

Dr. Al-Doori explains this well: with HTTPS, information travelling between you and the site is protected from eavesdroppers. That remains true and valuable. Today almost all web traffic uses it: Mozilla reported in 2025 that only about 2.4% of page loads in its Firefox browser still used plain, unencrypted HTTP.

What HTTPS Does Not Prove

Here is the crucial point: HTTPS proves that your connection is private. It does not prove that the site at the other end is honest.

Anyone can get a certificate for a domain they control, including a criminal who registers a look-alike domain for a fake bank. The connection to that fake bank is perfectly encrypted, which protects your password on its way to the criminal. As the US Federal Trade Commission (FTC) puts it, information can be encrypted on its way to a scam site and still not be safe from the people running that site.

This is not rare. Google's Chrome team wrote in 2023 that nearly all phishing sites use HTTPS. The Anti-Phishing Working Group (APWG) reported that about 84% of phishing sites used encrypted connections in the last quarter of 2020.

A simple way to remember it: HTTPS gives you a private line, not an honest partner. Today, a missing HTTPS is a red flag, but its presence is not a green flag.

Why Browsers Changed the Padlock

For years, browsers showed a padlock for HTTPS sites, and many people read it as "this site is safe". Google's research found that only about 11% of people in its study understood what the padlock actually meant. So, starting with Chrome version 117 in September 2023, Chrome replaced the padlock with a neutral "tune" icon (it looks like two small sliders), which you can click to see connection and site settings. Other browsers may still show a padlock, in different designs and places. Whatever the icon, its meaning is the same: an encrypted connection, nothing more.

Certificate Warnings: Don't Click Through

Sometimes, instead of the page you wanted, your browser shows a full-page warning saying the connection is not private or the certificate is not valid. This means the browser could not confirm it is talking to the real site. Sometimes the cause is a harmless mistake by the site owner; sometimes it is someone trying to intercept your connection, for example on a fake Wi-Fi hotspot (Lesson 5.9). You can't tell which from the warning, so the safe habit is simple: never click past a certificate warning. Go back, and try again later or on a different network. Never enter a password or payment details after a warning.

So How Do You Decide If a Site Is Real?

Use checks that a criminal cannot easily fake:

1. Read the domain, the real name in the address, as you practised in Lesson 2.3. Look-alike spellings and extra words are the classic trick.
2. Go there yourself. Use a bookmark, the official app, or type the address you know, instead of following a link from a message.
3. Notice your password manager. Reputable managers tie saved logins to the expected site. If it doesn't offer to fill in your password, stop and check the domain (Lesson 4.4).

Try It: Real or Fake?

Imagine three web addresses, all of which open with https and the normal connection icon. For each, decide what you would do before reading on. All domains ending in .test in this exercise are reserved for training and cannot be real public websites.

• 1. A text says your parcel is held: parcel-redelivery-help.test/track. You were not expecting a parcel.
• 2. You type your bank's address from memory and arrive at the familiar login page. The domain is the bank's usual one.
• 3. An email from "your university" links to youruniversity.test.login-portal.test/verify, asking you to confirm your password.

Suggested reasoning: Address 1 is unexpected and the domain is not the delivery company's; encryption changes nothing, so don't use it. Address 2 is the reliable pattern: you navigated yourself to a domain you know. Address 3 is a look-alike: the real domain is the end of the name just before the first single slash, login-portal.test, not your university's.

Real-World Example

In May 2023 the Chromium Blog, Google's official blog for the Chrome browser, announced the end of the padlock icon. Google explained that its research showed few people understood what the padlock meant, that the padlock does not indicate whether a site is trustworthy, and that nearly all phishing sites use HTTPS. The replacement "tune" icon arrived in Chrome 117 in September 2023. It is a rare case of a major company changing a famous symbol because the symbol had come to teach the wrong lesson.

From the Book to 2026

What the book teaches. Dr. Al-Doori explains that HTTPS encrypts the information passing between you and a site, shown by https:// and a padlock, and advises checking for both before entering a password or payment details.

Why it made sense. When the original text was written, many sites still used plain HTTP, even for logins, so checking for HTTPS was a meaningful way to avoid sending passwords where anyone nearby could read them.

What has changed. Security guidance has evolved since the original text. HTTPS is now almost universal, and criminals use it too: Google reports that nearly all phishing sites use HTTPS. Chrome replaced the padlock in 2023 so that people would stop reading it as a sign of trust.

What to do now. Current guidance now recommends treating HTTPS as necessary but not sufficient: check the domain, navigate to important sites yourself, let your password manager's behavior alert you, and never click past a certificate warning.

Watch: The Truth Behind the Padlock Icon on Your Web Browser

This two-minute video from Smarter with Joe makes this lesson's main point quickly and clearly, and shows the Chrome icon change.

As you watch, notice:

• the difference it draws between a secure connection and a safe website;
• why Google swapped the padlock for the "tune" icon, and that the new icon is meant to be clicked for more information;
• the reminder that other browsers may still show a padlock, in different designs and places.

The video reinforces what you just read — the lesson is complete without it.

What Would You Do?

You click a link in an email about a payment problem and arrive at a page that looks exactly like your online store account. The address starts with https and the connection icon looks normal, but your password manager does not offer to fill in your password. What do you do?

Knowledge Check

Key Takeaways

• HTTPS encrypts your connection; it does not prove the site is honest. Think "private line, not honest partner".
• Nearly all phishing sites use HTTPS, so its absence is a red flag but its presence is not a green flag.
• Chrome replaced the padlock with a neutral icon in 2023 because people read it as a sign of trust.
• Never click past a certificate warning.
• Judge a site by its real domain and by going there yourself; notice when your password manager won't fill in.

Sources

• Chromium Blog (Google) — An Update on the Lock Icon (2023)
• US Federal Trade Commission — Are Public Wi-Fi Networks Safe? What You Need To Know
• Mozilla — HTTPS-First in Firefox 136 (2025)
• APWG — Phishing Activity Trends Report, 4th Quarter 2020 (data)
• Dr. Tahseen Al-Doori — Cyber Security Essentials, Chapter 17