What It Actually Means
Without it, everything travels as plain text. Passwords, form submissions, whatever is on the page. Anyone positioned between the visitor and your server, which includes whoever runs the wifi in the coffee shop, can read it and can alter it in transit.
Why It Is Not Optional Any More
Three separate pressures made this a settled question rather than a choice.
Browsers mark it. Chrome and the others label plain HTTP pages “Not Secure” in the address bar, and warn more aggressively on anything with a form. Most visitors do not know what it means technically. They know it looks wrong.
Search treats it as a signal. Not a large one, but the comparison is not against a small penalty. It is against the behaviour of a visitor who arrives and sees a warning.
Modern features require it. Location, camera, notifications, service workers and payment APIs are unavailable over plain HTTP by browser policy, so an insecure site is progressively cut off from anything current.
What “Not Secure” Usually Means
Four causes, in rough order of how often they turn up.
No certificate at all, which for a live business site in the current decade is unusual and easily fixed.
An expired certificate. Same effect, worse presentation: an interstitial warning rather than a label.
Mixed content. The page itself is secure, and it loads an image, stylesheet or script over plain HTTP. The padlock disappears or the resource is silently blocked, which is why a site sometimes looks broken after a move to HTTPS. The fix is updating those references, and on a large site it is worth doing with a search rather than by eye.
No redirect. Both versions work, visitors land on whichever they typed or whichever is linked, and search engines see two copies of every page. This one is often missed precisely because the site appears fine.
What To Ask
- Does the plain address redirect to the secure one, every time? Type
http://deliberately and watch what happens. - Are there mixed-content warnings? The browser console reports them, and most are trivial once found.
- Do all four forms resolve to one? With and without www, secure and insecure, all ending in the same place.
- Is HSTS set? It tells browsers to refuse the insecure version in future. Worth having, and worth understanding first, because it is deliberately difficult to reverse.
The Thing People Overestimate
HTTPS protects data in transit. That is all it does, and it does it well.
It says nothing about whether the site is trustworthy, whether the business behind it is legitimate, or whether the data is safe once it arrives. Phishing sites use HTTPS routinely, and the padlock on one is exactly as genuine as the padlock on yours. It confirms the connection is private, not that the destination deserves it.
So HTTPS is a floor rather than an achievement. The certificate side of it, and what to buy, is covered under SSL certificates.
More terms are in the glossary.
