What HTTPS protects

HTTPS protects information while it travels between your browser and the server named in the address bar. It combines HTTP with TLS, which provides encryption and checks the server's identity using a certificate.

The name matters

A certificate is issued for particular domain names. Your browser checks that the name you requested matches the certificate and that its chain leads to a trusted certificate authority. A mismatch deserves investigation rather than a quick click past a warning.

Encryption has a boundary

HTTPS protects data in transit. The website itself can still read the information you send to it, and the connection does not prove that its content is accurate or its operator is trustworthy.

Keep the whole page secure

Pages should load their styles, images, and other resources over HTTPS too. Redirecting HTTP visits to HTTPS and renewing certificates on schedule keep the experience consistent.

The padlock is a useful sign about the connection. Good judgment about the site and the information you share remains just as important.