Almost every website now shows a padlock. It is a useful sign, but it says less than many shoppers think. Here is what it covers when the certificate is free and automatic.

This guide is based on the public sources listed at the end. We have not tested the products or services mentioned.

This is a short reference page. The full guide is Web Hosting and Domains: The Complete Guide.

What HTTPS is

HTTPS is the normal web protocol with encryption added (TLS). It hides data as it travels between your browser and the site and lets you detect changes along the way.

How a free certificate is issued

Let's Encrypt, a non-profit certificate authority, describes the process on its site:

  1. The site owner's software proves it controls the domain by answering a challenge: a DNS record or a file served over HTTP.
  2. The authority checks from several points on the network.
  3. After a signed request, it issues the certificate and logs it in public Certificate Transparency logs.
  4. Renewal repeats the process, and a certificate can be revoked with the account key.

The service is described as free, and many hosts set it up and renew it automatically.

What the padlock tells you

  • The connection to that domain name is encrypted.
  • Whoever requested the certificate controlled the domain when it was issued.

What it does not tell you

  • It does not show who the business is or that it is honest. The Let's Encrypt page does not claim it verifies anything beyond control of the domain.
  • It does not mean the shop will deliver, refund or protect your data. Our guide to checking whether an online store is legit covers the checks that do matter.

For site owners

Ask a host whether a free certificate is included and renewed automatically, and what happens if renewal fails.

The short version

The padlock means the connection to the domain is encrypted. It does not vouch for the business.

Last checked: 15 October 2026. Sources: Let's Encrypt, how it works.