What is an SSL certificate and why does the padlock matter?

Most of us have a vague idea that the padlock means "safe". It's a bit more complicated than that, and it's worth understanding, both as a website owner and as someone who clicks on links every day.

What is an SSL certificate?

An SSL certificate (technically it's called TLS these days, but nearly everyone still says SSL) does two jobs:

1. It encrypts the connection between your visitor's browser and your website, so anyone snooping along the way can't read what's being sent. Think of it as a letter in a sealed envelope instead of a postcard.
2. It confirms the website is who it says it is, so visitors can be confident they've reached the real site and not an imposter.

You can tell a site has one because its address starts with https:// instead of http://, and your browser usually shows a padlock icon beside the address.

Why your website needs one

• It protects visitor information. Anything people type into your site, such as contact forms, logins, bookings and payment details, is kept private on the way to your server.
• Browsers warn people without it. Chrome, Safari and other browsers label sites without SSL as "Not secure". That's not a great look when someone is deciding whether to trust you.
• It helps with Google. HTTPS is a small ranking signal, and it's now the expected standard for every website.
• Modern features need it. Many newer web technologies simply won't work on a site without HTTPS.
• It builds trust. Especially if you ask people for their name, email address or payment.

Even a simple brochure site with no forms should have one. There's no good reason to go without.

What the padlock does not mean

This is the important bit, particularly when it comes to scams.

The padlock doesn't mean a website is trustworthy. It means the connection is encrypted. Scammers can, and do, get SSL certificates for their fake websites, so a phishing site pretending to be your bank can show a perfectly good padlock.

So remember:

• A padlock means your connection to that particular site is private.
• A padlock does not mean the site is honest, legitimate or safe to give your details to.

Always check the web address too. Look carefully at the spelling and the domain ending. A site at "yourbank.co.nz.secure-login.example" isn't your bank. The real domain is the part that sits just before the first single slash, so in that example it's "secure-login.example".

If an email has sent you to a login page and you're unsure, close it and go to the site by typing the address yourself. Our guide on how to check an email really came from us walks through the warning signs.

Types of SSL certificate

You may see a few options when you're looking at hosting or certificates:

• Domain Validated (DV): Confirms you control the domain. Quick to issue, often free, and the right choice for most websites. Free Let's Encrypt certificates, which are included with all our hosting, are this type.
• Organisation Validated (OV): Also checks your business details before the certificate is issued. Usually used by larger organisations.
• Extended Validation (EV): The most thorough checks. Browsers no longer display these any differently from other certificates, so most small businesses don't need one.

Some certificates also cover wildcard domains, meaning every subdomain (such as shop.yourdomain.co.nz and mail.yourdomain.co.nz) rather than just one address.

How to get an SSL certificate

For most people it's straightforward:

1. Check your hosting plan. All our hosting includes free Let's Encrypt SSL certificates, which are installed and renewed automatically once they're switched on in the control panel.
2. Make sure it's switched on for your domain (and the www version) in your control panel.
3. Force HTTPS. Make sure anyone who types the http:// version of your address is automatically sent to the https:// version. In WordPress you can do this with a plugin, or by updating your site address under Settings.
4. Fix "mixed content". If some images or scripts still load over http://, browsers may show a warning even with a valid certificate. A plugin or a careful search-and-replace in the database will usually sort this out.

If you'd rather not deal with any of this, just ask. Our support team is here in New Zealand and can help you get it set up properly.

Common SSL problems

• "Your connection is not private" warning. This usually means the certificate has expired, doesn't match the domain name, or isn't installed properly.
• Certificate expired. Certificates need renewing regularly. On our hosting, Let's Encrypt certificates renew automatically when they're switched on, but it's worth checking if you ever see an error.
• Works on www but not without it (or the other way around). The certificate needs to cover both versions of your address.
• Padlock with a warning symbol. This is typically the mixed content issue described above.

A security warning on your website is a big red flag for visitors, and many will leave rather than click through it. If you see one on your own site, contact our support team and we'll look into it straight away.

How to check a site's certificate

Click the padlock (or the icon beside the address) in your browser, then choose the option to view the connection or certificate details. You'll see who the certificate was issued to, who issued it, and when it expires.

It's a handy habit when something feels off. A certificate issued to a name that has nothing to do with the business you thought you were dealing with is a good reason to stop and check.

Spotted a fake site?

If you've come across a scam website pretending to be a business you deal with, report it. Our guide on where to report scams in NZ lists who to contact, from Netsafe to the National Cyber Security Centre.

The short version

An SSL certificate keeps information private on its way between your visitors and your website, and it's a must-have for every site. Just remember that the padlock tells you the connection is secure, not that the website is trustworthy. Check the address, and trust your instincts.

Need help with SSL on your site? Talk to our team and we'll get it sorted, or have a look at our NZ web hosting plans, which all include free SSL certificates.