HTTPS and the padlock
🏠The everyday picture
A postcard versus a sealed, tamper-proof envelope with a verified sender's stamp. Anyone handling a postcard can read it. The envelope keeps the message private, and the stamp proves who sent it.
📘What it really is
-
HTTP sends everything as readable text. Anyone on the path (a public Wi-Fi, for example) could read or change it.
-
HTTPS is HTTP with encryption (TLS). It gives you:
- privacy: nobody in between can read passwords, messages or card numbers;
- integrity: nobody can secretly change the page;
-
identity: a certificate proves the site really is the domain in the address bar.
-
Certificates are issued by trusted authorities. Many hosts, including Hostinger, give free ones (often from Let's Encrypt) and renew them automatically.
-
The padlock or settings icon in the address bar means HTTPS is working. "Not secure" means it isn't.
- HTTPS proves who you're talking to, not that they're honest. A scam site can have HTTPS too.
🖱️Try it
Open your test site, test.prolearners.in. Click the icon to the left of the address and look at the connection and certificate details: who issued the certificate, and when it expires.
✅Quick check
A login page shows "Not secure" in the address bar. Should you type your password?
Show the answer
No. Without HTTPS, the password could be read on its way to the server.
A website has a padlock. Does that prove it's trustworthy?
Show the answer
No. It proves the connection is private and the domain is genuine, not that the people behind it are honest.