A business website should protect information sent between a visitor’s browser and its server. HTTPS uses Transport Layer Security (TLS) for this connection. The term “SSL certificate” is still used informally, but SSL is the older predecessor to TLS.
What HTTPS protects
TLS encrypts data in transit, helps detect changes to that data and authenticates the server’s domain. These protections matter when visitors read pages, submit forms or sign in. They are described in MDN’s Transport Layer Security documentation. MDN: Transport Layer Security.
What a certificate does not prove
A working HTTPS connection does not establish that a business is honest or that everything on its website is safe. Chromium’s explanation of its lock-icon change makes this distinction clear. A deceptive site can also use HTTPS. Chromium: An Update on the Lock Icon.
Website owners still need to maintain their applications, manage access, protect stored information and review third-party services. HTTPS covers the connection; it does not replace those responsibilities.
Questions for your website provider
- Is HTTPS enabled across the website and its page resources?
- Who owns certificate renewal and monitors failures?
- Are forms and external services configured to protect the information they handle?
- How will the team detect and resolve configuration problems?
Ask for a clear owner and a documented maintenance process. A certificate should be part of routine website operations rather than a one-time purchase treated as a complete security solution.