The padlock is two promises, not one

The padlock in the address bar is doing two different jobs at once — and knowing which is which explains everything from why certificates are free to why a padlocked site can still be a scam.

Promise one: privacy. Everything between the browser and the server is encrypted — passwords, card numbers, and the pages themselves are unreadable to anyone in between: the coffee-shop Wi-Fi, the ISP, anyone on the path.

Promise two: identity, narrowly defined. The certificate proves you are talking to the server that genuinely controls that domain name — not an impostor answering in its place. Note what it does not promise: that the domain belongs to who you think, or that the business behind it is honest. A phishing site at a lookalike domain gets a padlock too, because it really does control that lookalike domain. The padlock means private and unimpersonated, never trustworthy.

What happens in the handshake

The elegant problem TLS solves: two machines that have never met agreeing on a secret key while someone potentially listens to every word. In outline, in milliseconds:

The browser says hello and lists what it supports. The server replies with its certificate — its public key, signed by a certificate authority the browser already trusts. The browser checks that signature, the domain name, and the expiry date. Then the two use public-key cryptography — where anyone may lock but only the private-key holder can unlock — to agree a fresh session key, and switch to fast symmetric encryption with it for everything after.

The detail worth appreciating: the eavesdropper hears the whole negotiation and still cannot derive the key. That is the mathematical trick the entire padlock rests on, and modern setups add forward secrecy on top — even a server key stolen later cannot decrypt recordings of past sessions.

Why it matters beyond the padlock icon

Even a site with no logins and no payments has three practical reasons to care. Browsers punish HTTP: “Not secure” labels in the address bar are a conversion problem regardless of what your site does. Search engines prefer HTTPS: it has been a ranking signal for years, and mixed HTTP/HTTPS states cause exactly the duplicate-URL mess canonical tags exist to prevent. Integrity: without encryption, anything on the path can modify your pages in transit — injected adverts on hotel Wi-Fi were a real industry before HTTPS became default. The padlock is also a tampering seal.

Free certificates changed everything

Certificates used to cost real money yearly, which meant much of the web went unencrypted. Let's Encrypt broke that in 2016: free, automated, 90-day certificates issued by proving domain control, renewed by software with no human involved. It now secures most of the web, and the short lifetime is a feature — automation is mandatory, so certificates stop expiring in forgotten calendars.

Two consequences for you as a site owner. First, any host still charging for basic SSL is charging for something the industry gives away — treat it as a pricing-page tell. (Paid certificates still exist legitimately for organisation validation; a normal site needs none of that.) Second, issuing is tied to DNS: the authority verifies your domain points where you claim, which is why a new certificate cannot issue until propagation completes after a move — and why cert errors right after DNS changes usually just mean wait, then retry.

Checking your own site is set up correctly

Four checks, two minutes:

The padlock is present on your pages — on Traxio, certificates issue automatically once DNS resolves. HTTP redirects to HTTPS: type the http:// version explicitly and confirm you land on https:// — if not, one .htaccess rule fixes it. No mixed content: a padlock with a warning triangle means some image or script still loads over HTTP; the browser console names the culprits, and it is almost always old hardcoded http:// URLs in content. An external check agrees: run the domain through SSL Labs' server test occasionally — an A means the configuration, not just the certificate, is right.

Then add the belt-and-braces header, HSTS, which tells browsers to refuse plain HTTP for your domain entirely — closing the brief window even a redirect leaves open. One line in .htaccess, covered in the security basics guide.