SSL and the padlock: what it does and does not mean
Every site should have the padlock, and every site we manage does. But it is worth knowing what it actually promises.
What it means
Traffic between the visitor and the site is encrypted, so nobody on the café wifi can read the form they fill in. Browsers now mark sites without it as "not secure", and Google ranks them lower.
What it does not mean
That the site is honest, well-built or safe from being hacked. A phishing site can have a padlock. Encryption is the floor, not the ceiling.
The bit that goes wrong
Certificates expire. When one lapses, the site shows a full-page warning and visitors leave. On managed sites the certificate renews automatically and we are alerted if renewal fails, which is the kind of dull job a managed service exists to do.
Want a hand with this?
Send a few lines and you get a plain answer within two working days.
More from the blog
Why a managed website beats a one-off build for most small businesses
A website is not a purchase, it is a running service. Here is what goes wrong with the one-off model and why paying monthly usually works out better.
Editing your own website without breaking it
Every site we build comes with a simple editor. Here is what you can safely change yourself, what to leave to us, and a few habits that keep things tidy.