What Is HTTPS, and Is the Padlock Enough?

HTTPS is the secure version of the web's basic protocol: it encrypts the pages, passwords and forms that travel between your browser and a website, so people on the same network cannot read or change them. The padlock in the address bar means the connection is encrypted and the site holds a valid certificate for its name. It does not mean the site itself is honest.

Checked on 4 November 2026.

What does the HTTPS padlock actually prove?

The padlock proves two things. First, the connection between your device and the site is encrypted, so a café or hotel network cannot read your password or card number in transit. Second, the site showed a certificate that a trusted authority issued for that exact web address. It proves nothing about who runs the site: a phishing page can get a free certificate in minutes and show the same padlock as your bank.

How do you check a site's HTTPS connection on iPhone?

In Safari, look at the address bar. A site without HTTPS shows Not Secure next to the address.

Tap the address and read the full web address, letter by letter. Look for swapped letters or extra words, such as paypa1 or apple-support-login.

If Safari shows a full-page warning that the connection is not private, close the page. Do not tap through the warning on a site where you sign in or pay.

Type the address of your bank or email yourself, or use its app, instead of tapping a link in a message.

What can others still see when a site uses HTTPS?

HTTPS hides what you do on a page, but not which site you visit. The Wi-Fi owner and your internet provider can still see the names of the sites you connect to, when, and how much data you use. Apps that do not use HTTPS correctly, and old devices, can also leak more than you expect.

Is HTTPS enough on public Wi-Fi?

HTTPS protects the content of each page, which is a big step. On a network you do not control, a VPN adds the missing layer: it encrypts all of your traffic from your phone to the VPN server, including which sites and apps you use, so the café, hotel or airport network sees only that you are connected to a VPN.

Frequently asked questions

Does a padlock mean a website is safe?

No. It means the connection is encrypted. Phishing sites use HTTPS too, so always check the web address itself.

Is HTTP without the S ever OK?

Only for pages where you type nothing and nothing private is shown. Never sign in or pay on a page marked Not Secure.

Do I need a VPN if every site uses HTTPS?

HTTPS protects what you send to each site. A VPN also keeps the list of sites and apps you use private from the network you are on.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Learn more in How to spot a phishing message in 30 seconds or Download CasperVPN →