The padlock next to your web address is the most misunderstood icon on the internet. Google thought so too, which is why Chrome took it away.

What your SSL certificate actually does

SSL stands for Secure Sockets Layer. Don't be impressed, it's a 1990s name for a very boring job! It scrambles whatever people type into your site, so nobody in the middle can read it.

Without it, your contact form is a postcard. Anyone handling the post reads the name, the number, and whatever went in the message box.

That's the whole job. It looks after the trip from your visitor's phone to your server.

What happens to you without one

With no certificate, Chrome marks your site as insecure and flags every form on the page. If yours has expired, it's worse: a full-screen red warning where your home page should be.

You won't notice a thing. Your browser is talking to your customers on your behalf now, and it isn't kind.

Do people read the red screen and weigh the risk? No. They hit back, try the next result, and you're none the wiser.

Google treats https as table stakes now, not a bonus. So does every browser your customers use.

What the padlock never told you

Here's why we're sure. Google found in 2021 that only 11% of study participants correctly understood the padlock, so Chrome 117 dropped it in 2023.

Nearly every phishing site runs https. So they all had a padlock too, and your customers couldn't tell the difference.

A padlock only ever proved your connection. Never your site.

A hacked site running 40 out-of-date plugins reports the same secure connection your bank does. It's a deadbolt on the front door of a house with no back wall!

How to check yours in 10 seconds

Click or tap the icon to the left of your web address. Your browser will tell you in plain words whether the connection is secure.

Then open the certificate details and read the expiry date. That's the number you want, because certificates lapse quietly and take your home page with them.

You've probably had one all along. Decent hosting includes a free certificate, so if someone bills you a serious annual fee, ask them what for.

Encryption is one job. Updates, backups and malware scans are a different job, which is what our maintenance plans cover.

Yes, we keep a calendar of other people's certificate expiry dates. Nobody has ever asked us about it at a braai!

Go and find your expiry date this week, and get your host to sort it if nobody knows. Then remember the certificate was never the security part!