What HTTPS protects
HTTPS uses TLS to protect communication between the browser and the server. It helps prevent information in transit from being read or altered by an intermediary and uses certificates to authenticate the server connection. Modern secure websites use TLS even when people informally call the certificate an SSL certificate.
This is protection for the connection, not a promise that every feature or organisation behind the site is trustworthy. MDN explains HTTPS. Application permissions, stored data and account security still require their own controls.
Example: securing the whole enquiry journey
Consider a business contact page that loads securely but submits its form to an old HTTP address. Checking only the address bar before submission would miss that problem. The form endpoint, supporting resources and confirmation route should all use the intended secure connection.
A migration can also leave images or scripts pointing to an old insecure origin. Some mixed content may be upgraded or blocked by the browser, causing missing visuals or broken behaviour. Review the browser’s network and security messages, then update the source references rather than relying on visitors to accept warnings.
Practical checks after installation or migration
Check the certificate covers the actual hostnames customers use and that renewal is maintained. Test the main domain and www version, confirm the preferred address, and review redirects from old HTTP links. Make internal links, canonical URLs and sitemap addresses consistent with the secure destination.
Do not assume HTTPS prevents a compromised administrator account or a vulnerable plugin from exposing data after it reaches the server. Keep authentication, updates and backups in the maintenance plan. If a certificate warning appears, investigate its cause; asking customers to bypass the warning undermines the protection HTTPS is intended to provide.
Common questions about https
Does HTTPS encrypt data stored in my database?
Not by itself. HTTPS protects transport between endpoints. Database encryption, access permissions and retention are separate parts of the application and hosting setup.
Can a fraudulent website use HTTPS?
Yes. An encrypted connection does not prove that a business is legitimate. Customers should still consider the identity and credibility of the organisation they are dealing with.
Related definitions
- TLS — Transport Layer Security, the protocol used to encrypt and authenticate modern secure web connections.
- SSL certificate — A commonly used term for the certificate supporting an authenticated encrypted website connection. Modern secure connections use TLS.
- Authentication — The process of checking an identity, such as verifying a signed-in user, application or service before granting access.
- HTTP status code — A response code communicating the result of a request. Examples include 200 for a successful response, 301 for a permanent redirect and 404 for a resource not found.
Related SEO guides
HTTPS protects the connection and must be maintained with valid certificates and consistent secure page addresses.
For help connecting these decisions with your website, explore our SEO services or start with an SEO audit.
Put it into practice
Explore our website security service or talk with Refined IT about applying this to your website or business systems.