It sounds like this“If the padlock is showing, the site is safe and honest.”
Thinking the padlock means a site is safe
Why it feels right
For years the advice was 'look for the padlock'. The lock icon looks like a guarantee, and a lock means security in every other part of life. If a site shows one, it feels as though somebody has checked it out and given it the all-clear.
Why it’s wrong
The padlock means your connection to that exact address is private and hasn't been altered on the way. It says nothing about who runs the site or whether they are honest. Most phishing sites now have a padlock too.
A worked example
A padlock tells you two things. The data between you and that address is scrambled, so nobody on the way can read or change it. And the address you are talking to has proved it holds a certificate for that name. That is all.
It does not tell you who owns the name. A site called examp1e-bank.com, with the number 1 in place of the letter l, can obtain a certificate for that exact name, easily and free, because certificates are issued to whoever controls the domain. The connection to the fake bank is perfectly private. It is just private with a thief.
This is why browsers have mostly stopped showing the lock as a mark of trust, and why most phishing sites now use HTTPS. The lock is the start of a check, not the end. Read the address carefully, and never treat the padlock as a sign of honesty.
How to catch yourself
- You tell people to 'look for the padlock' to know a site is trustworthy.
- You think a scam site couldn't have HTTPS.
- You stop reading the address once you see the lock.
What to hold instead
The padlock means the connection to that exact address is private and unaltered. It doesn't say who runs the site or whether they can be trusted, and phishing sites can have it too.
Where you’ll meet it
- Checking a link in an email that claims to be from your bank.
- Teaching a relative how to shop online safely.
- Reading why browsers changed the padlock icon.
Questions people ask
- Does the padlock mean a website is safe?
- No. It means your connection to that address is encrypted and the address matches a valid certificate. A fraudulent site can have both. You still need to check the address itself and whether you trust the site.
- Do phishing sites use HTTPS?
- Yes, most of them do now. Free certificates are easy to get for any domain, so the padlock is no longer a sign that a site is genuine.