What the lock in the address bar really means

The little lock in the browser means one thing. The connection between the visitor and your site is encrypted, so nobody in between can read or change what's sent.

It doesn't mean the site is honest, and it doesn't mean the site has no other problems. Scam sites get the lock too.

What makes the lock work

Your site needs a certificate, a small file that proves to browsers that they reached the real site. Most hosts issue and renew one for you.

Things still go wrong around it.

• The certificate covers example.com but not www.example.com, so one of them shows a warning.
• The site also answers on plain http://, and a visitor who types the address lands on the unencrypted version first.
• A page loads a script or image over http://, which weakens the whole page.
• The server still accepts very old versions of encryption.

The one setting that helps most

HSTS tells browsers to always use the encrypted version of your site, even if someone types http://. Once a browser has seen it, the unencrypted version is never used again for that visitor.

A scan checks the certificate, the redirect, mixed content and HSTS, and says which parts need attention.