Skip to content

Understand SSL, TLS, and what HTTPS protects

Summary

Understand how TLS protects HTTPS connections. Check URLs, certificate warnings, external resources, and why a connection icon does not establish trust.

Published

HTTPS protects the connection while trust requires separate judgment

TLS is a communication protocol protecting against eavesdropping and tampering. HTTPS uses it for the web; the earlier name SSL remains in some descriptions. MDN explains TLS as a secure communication protocol. (MDN TLS)

Use protected page and submission connections and inspect certificate warnings. Assess the operator and published information separately from connection protection.

Inspect the URL and browser connection information

Check the HTTPS URL and any certificate warning. Browser indicators differ, so use the connection information instead of relying on a lock shape.

Keep the icon's meaning separate from trustworthiness

Chrome described confusion between the lock and site trust, and announced a move to a settings-style indicator. Fraudulent sites can also use HTTPS. (Chromium connection icons)

For warnings, investigate the address, certificate expiry, and matching hostname before entering information. Operators should fix the cause and recheck the connection.

Inspect resources and form destinations

An HTTPS page can request images or scripts through HTTP. This is mixed content, which browsers may upgrade or block. (MDN mixed content)

Correct unavailable resources according to their delivery method

Compare the resource URL with browser warnings. Use a supported HTTPS destination where available. Check that the form's submission connection is protected too.

Assign setup and renewal responsibilities

Record who configures certificates and receives expiry notifications. Read the work needed for an added custom domain even where hosting includes certificate management.

Check the contact process and image-containing pages as well as the homepage. See Web server responsibilities for the delivery environment.

SpreadSite is a no-code website builder that lets you create, publish, and update a website from Google Sheets using ready-made templates.

To build a website while reviewing connection protection and ongoing management, give SpreadSite a try!

Build a website with SpreadSite →

Frequently asked questions

Q: Are SSL and TLS identical names?

A: SSL names the earlier protocol. Its successor TLS is used for modern connections, though SSL remains in some product descriptions.

Q: Does no lock icon mean no HTTPS?

A: Indicators vary by browser. Check the URL, connection information, and certificate warnings.

Q: Does HTTPS establish content trustworthiness?

A: Connection protection and the reliability of the operator or content are separate judgments.

Q: What should I investigate for a missing image?

A: Check its URL, HTTPS availability, and browser warning, then correct the delivery method.

Sources

Build a website with Google Sheets using SpreadSite