Jump to a section +
The padlock question often appears at the end of a website project: “Is the site secure now?” It cannot be answered with one badge. A certificate can make the network connection private and authenticated while an outdated plugin exposes the application, a shared password exposes the administrator account, or a form sends sensitive information into an ordinary inbox. Security depends on the path data and control take through the whole system.
For a nontechnical owner, the useful distinction is between connection security and business-system security. HTTPS is a baseline connection control. Accounts, software, hosting, integrations, data handling, monitoring, backups, and response are separate controls with separate owners. A provider should be able to explain each without claiming the site is “unhackable.”
Understand what the certificate actually proves
“SSL” is the older protocol name that survives in product language. Current HTTPS deployments use TLS. RFC 8446 specifies TLS 1.3, while browsers and servers may support other current versions according to their policies. Business owners do not need to configure cipher suites blindly; they do need a supported hosting configuration whose TLS settings and certificate lifecycle have a named owner.
Treat a certificate as strong evidence for a narrow claim, not a universal security seal.
| HTTPS helps with | HTTPS does not establish | Separate control |
|---|---|---|
| Encrypting traffic between a compatible client and the HTTPS endpoint | That the server, browser, or customer device is free of malicious software | Endpoint, hosting, and device security |
| Detecting modification of protected traffic in transit | That content entered into a form is stored, emailed, shared, or retained safely afterward | Application design and data governance |
| Authenticating that the certificate covers the requested domain under the trust model | That the organization behind the domain is honest, licensed, solvent, or suitable | Independent business verification and truthful content |
| Protecting cookies when correctly configured with relevant attributes | That sessions cannot be stolen through application flaws or compromised accounts | Secure application and identity controls |
| Enabling browser features that require a secure context | That every image, script, frame, API, or vendor used by the page is trustworthy | Dependency inventory and integration review |
Make issuance and renewal an owned system
Many managed hosts and content platforms provision and renew certificates automatically. Automation reduces routine work but does not remove dependencies. Renewal can fail when DNS, domain validation, account permissions, rate limits, hostnames, proxy settings, or the provider relationship changes. Record who supplies the certificate, which names it covers, how validation occurs, and where expiration or failure alerts go.
Document the certificate lifecycle
Inventory every public hostname
Include the apex domain, www, active subdomains, customer portals, campaign tools, and legacy names that still receive traffic. A certificate for one hostname does not automatically cover another.
Identify the issuer and automation
Record whether the host, CDN, platform, or your team requests the certificate, which ACME client or managed process it uses, and who can change that configuration.
Understand validation dependencies
Let’s Encrypt documents HTTP-01, DNS-01, and TLS-ALPN-01 challenge types. The chosen method may depend on DNS credentials, web routing, or platform support; use the provider’s supported configuration.
Monitor from outside
Use an independent check for expiry, name mismatch, trust-chain errors, and HTTPS reachability. Send alerts to a current business-owned destination with a backup contact.
Test change scenarios
Include certificate issuance in host migrations, domain additions, CDN changes, account transfers, and disaster recovery. The new environment should serve valid HTTPS before traffic is switched.
Do not buy a more expensive certificate merely because its marketing implies stronger encryption. Certificate products differ in validation, warranty language, management, support, coverage, and organizational needs, but connection strength also depends on server and client configuration. Choose from an actual requirement and document renewal; price alone is not a security architecture.
Move the whole website to HTTPS carefully
A valid certificate is necessary, but the website still needs a complete HTTPS configuration.
| Check | Failure pattern | Owner action |
|---|---|---|
| HTTP redirect | Some HTTP URLs remain live, loop, or redirect through several hosts | Use direct permanent redirects to the matching HTTPS URL and verify important legacy paths |
| Canonical URL | Pages load on HTTPS but declare an HTTP canonical | Update canonical, sitemap, hreflang, feed, and internal URL signals to the intended HTTPS version |
| Mixed content | The page is HTTPS but requests an HTTP image, script, frame, font, or API | Replace or remove the insecure resource and retest relevant templates and embedded tools |
| Forms and APIs | The page is secure while the action posts to an insecure or unexpected endpoint | Inspect destinations, redirects, integrations, cookies, errors, and data handling end to end |
| Multiple names | www works but the apex domain, a subdomain, or alternate name shows a warning | Cover and route every intended public name; retire unused names deliberately |
| Third-party tools | Chat, booking, payment, video, or analytics loads from an unreviewed host | Inventory vendors, permissions, data flow, script behavior, support, and failure states |
Mozilla’s mixed-content guidance explains that a secure page can become less safe when it loads subresources over HTTP. Browsers block some mixed content and may upgrade other requests, but do not rely on browser repair. Find the source in templates, stored content, stylesheets, embeds, tag managers, and integrations, then change or remove it.
- Every intended public URL reaches the correct HTTPS page without a certificate warning or avoidable redirect chain.
- Internal links, structured data, canonical tags, XML sitemaps, social metadata, and forms use the intended secure URLs.
- Cookies that carry sessions or sensitive state use appropriate Secure, HttpOnly, and SameSite behavior for the application.
- Security headers are selected and tested for the site’s real resources; they are not pasted from a checklist without compatibility review.
- Monitoring checks both certificate validity and a meaningful page or transaction, because a valid certificate can sit in front of a broken site.
- The certificate and private key, when self-managed, are handled through an approved secrets process rather than email or shared documents.
The certificate participates in authenticating the domain and establishing an encrypted connection; it does not audit everything behind the domain.
Protect the accounts that control HTTPS and the site
A registrar, DNS, hosting, CDN, CMS, source repository, email, or identity-provider account can change what visitors receive. Protect those control points more strongly than an ordinary newsletter login. Use business-owned accounts, unique credentials in an approved password manager, strong phishing-resistant MFA where supported, current recovery contacts, and more than one authorized administrator without sharing one identity.
CISA’s small-business guidance emphasizes MFA, software updates, backups, and phishing awareness. Apply least privilege: a person who edits an article usually does not need DNS, billing, plugin installation, user management, or deployment rights. Review access when staff or vendors change, and preserve logs where the service provides them.
Secure the application beyond the connection
A practical website security baseline
Keep supported software current
Inventory the platform, runtime, themes, plugins, libraries, and custom code. Apply security updates through a tested process and replace components that no longer receive support.
Reduce the dependency surface
Remove unused plugins, apps, scripts, users, API keys, staging sites, and old integrations after confirming the removal plan. The plugin and app audit provides a full dependency review.
Protect data through its lifecycle
Collect only needed information, use an appropriate system, limit access and retention, secure integrations, and provide a safe error and support path. HTTPS protects transit, not every later copy.
Log and monitor useful events
Watch availability, certificate state, administrative changes, authentication alerts, form or transaction failures, and provider notices according to the system’s risk and capabilities.
Maintain tested recovery
Back up the content, data, configuration, code, and ownership records needed to restore the service. Test that a responsible person can recover them; use the website backup and recovery guide to define scope and targets.
Prepare a calm response to warnings or compromise
When a certificate warning or suspected incident appears
Preserve the exact evidence
Record the URL, time, device, browser message, screenshot, recent changes, and who reported it. Do not ask customers to bypass a warning.
Use a trusted contact route
Reach the host, platform, registrar, security provider, or internal owner through a known portal or verified number, not a link inside an unexpected alert.
Scope before changing everything
Determine whether the issue is expiry, hostname mismatch, trust chain, DNS, one device, mixed content, hosting outage, account compromise, malicious code, or another application failure.
Contain with qualified help
Restrict affected access or systems according to the response plan while preserving evidence. A hurried restore over a compromised environment can erase clues or reintroduce the cause.
Recover and communicate accurately
Use verified clean sources, rotate affected credentials, test critical paths, monitor for recurrence, and obtain appropriate technical, legal, insurance, and communications guidance for the facts.
Security work continues after launch because certificates renew, accounts change, dependencies age, and business processes evolve. Web Respawn’s website care plans can provide a defined maintenance and monitoring role, while the platforms, hosting, and ownership library helps owners separate domain, hosting, access, backup, and provider responsibilities.
Is an SSL certificate required for a website with no payment form?
A public business site should use HTTPS even without checkout. Visitors may submit forms, follow links, receive cookies, or simply need confidence that the content came from the intended domain without in-transit alteration. Modern browsers and platform features also expect secure contexts.
Does the padlock mean a website is safe and legitimate?
No. It means the browser established an HTTPS connection under its certificate-validation and TLS rules. A deceptive or compromised site can also obtain a valid certificate. Evaluate the business, content, software, accounts, data practices, and transaction separately.
Are free certificates less secure than paid certificates?
Price does not by itself determine the strength of an HTTPS connection. Products can differ in validation model, management, support, coverage, warranties, and organizational requirements. Use a trusted issuer and supported configuration that fits the requirement, renews reliably, and is monitored.
What causes a certificate to stop working?
Common causes include expiration after renewal failure, a hostname not covered by the certificate, an incomplete or untrusted chain, DNS or proxy changes, an incorrect server binding, a client clock problem, or platform configuration changes. Preserve the exact warning and have the responsible provider diagnose it.
Evidence behind the guide
Sources and further reading
- How Let’s Encrypt worksLet’s Encrypt
- TLS 1.3 — RFC 8446RFC Editor
- Mixed contentMozilla Developer Network
- Cyber Guidance for Small BusinessesCybersecurity and Infrastructure Security Agency
- Require Multifactor AuthenticationCybersecurity and Infrastructure Security Agency
Continue on Web Respawn
Pages that actually connect to this decision.
These links are selected for the subject of this guide. They are not a generic service dump.
