What Is HTTPS? The Padlock, Explained for Beginners

Open almost any website and there's a small padlock (or a settings icon) next to the address. Open an old or badly set-up site and the browser says Not secure instead. The difference is HTTPS, and every app you launch needs it.

HTTP and HTTPS

HTTP is the language browsers and servers use to talk: "give me this page," "here it is." It was designed in the early 1990s and sends everything as plain text. Anyone sitting between you and the server — on the same café Wi-Fi, at your internet provider, on a compromised router — can read it, and can change it.

HTTPS is HTTP with encryption on top (the S stands for secure). The browser and server agree on a secret key, and everything they send is scrambled with it. Someone in the middle sees gibberish.

The encryption layer is called TLS. You'll also hear the older name, SSL — people use the two interchangeably, and "SSL certificate" is still the common phrase.

What HTTPS protects

Privacy. Passwords, form contents, cookies, and page contents can't be read in transit.
Integrity. Nobody in the middle can alter the page — no injected ads, no swapped download links.
Identity. The browser checks that it's really talking to yourapp.com, not an impostor.

What HTTPS doesn't protect

The padlock means the connection is secure. It says nothing about the site itself:

A scam site can have a perfectly valid padlock.
If your app has a security hole — a page that shows other users' data, say — HTTPS delivers that data securely to the wrong person.
Data stored in your database isn't encrypted by HTTPS. That's a separate concern.

HTTPS is the minimum, not the whole job. A Security Checklist for Vibe-Coded Apps covers the rest.

What a certificate is

For the identity part to work, your server needs a certificate: a small file that says "this server is allowed to speak for yourapp.com," signed by a certificate authority the browser trusts.

The browser has a built-in list of trusted authorities. When it connects, the server presents its certificate; the browser checks the signature, the domain name, and the expiry date. If anything's wrong, you get a full-page warning like "Your connection is not private."

Certificates used to cost money and take hours to set up. Today, Let's Encrypt issues them free, automatically, in seconds — and most hosting platforms request and renew them for you. How Automatic SSL Works explains the machinery.

Why your app needs it

Browsers warn visitors away from plain-HTTP pages, especially ones with forms.
Features stop working without it. Many browser features — location, camera, clipboard, service workers, secure cookies — only work on HTTPS pages (with an exception for localhost during development).
Payments, login, and "Sign in with Google" require it. Payment providers and login providers refuse plain-HTTP redirect addresses.
Search engines prefer it.

There's no longer a reason to run a public site without it.

The common problems

"Not secure" on your own domain. You've connected a domain but the certificate hasn't been issued yet, or the host doesn't issue one automatically. Check your host's domain settings. Certificate issuance needs your DNS to point at the host first — see How to Connect a Custom Domain to Your App.

"Your connection is not private" / certificate errors. Usually one of:

The certificate has expired — renewal failed.
It's for the wrong name — issued for yourapp.com but you visited www.yourapp.com, which needs its own entry.
Your computer's clock is wrong, which makes valid certificates look expired.

Mixed content. The page loads over HTTPS but includes an image, script, or API call over plain http://. Browsers block or warn about these. Fix: change every http:// link to https:// (or to a relative path). Your browser's developer console lists each blocked item.

Redirect loops. "Too many redirects" often means two layers both trying to force HTTPS — for example a CDN talking to your server over HTTP while your server redirects everything to HTTPS. Configure one place to handle it.

A quick check

Your site loads at https:// with a padlock
http:// redirects to https:// automatically
Both yourapp.com and www.yourapp.com work (or one redirects to the other)
No mixed-content warnings in the browser console
Certificates renew automatically — you shouldn't have a calendar reminder for it

EasySpawn issues and renews Let's Encrypt certificates automatically for every app and custom domain you connect, so HTTPS is on from the first deploy. See how it works or join the waitlist.