Secordit home
Contact

What is HTTPS?

HTTPS uses TLS, or Transport Layer Security, to protect data in transit between your browser or app and the service. That connection is often shown as a padlock in the browser. A padlock shows that the connection to that site is encrypted. It does not, on its own, prove that the site is the organisation you have in mind. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Your browser or app opens a connection to a website or service. 12
  2. TLS encrypts the data in transit. That connection is often shown as a padlock in the browser. 12
  3. People who run servers are told by the NCSC to use TLS 1.3 where they can. They should plan a move from TLS 1.2, and disable TLS 1.1, TLS 1.0 and all SSL. This page explains the idea, not a full server setup. 1

How it can look

The NCSC's 2017 KRACK guidance describes HTTPS as the protection used for email, internet banking and online shopping. That connection is often shown as a padlock in the browser. A later NCSC note on TLS also points out that phishing sites use TLS too, to look more believable. A padlock tells you the connection is encrypted. It does not, on its own, prove that the site belongs to the organisation you have in mind. 23

Warning signs

  • A site asks for a sign-in or a payment without HTTPS. 2
  • A page has a padlock, but the address is a lookalike of the organisation you expected. 23
  • An older service still uses TLS 1.1, TLS 1.0 or SSL, which the NCSC says should be disabled by people who run servers. 1

What to do now

  1. Look for HTTPS and the padlock before you enter a password or payment details, especially for email, banking and shopping. 2
  2. Check the address itself, because a padlock can also appear on a lookalike site. 23
  3. If you run a website, follow the NCSC TLS guidance, including current versions, and mark cookies as secure so they travel only over TLS. 1

UK reporting and support

  • If you entered details on a lookalike site, follow the NCSC help for a hacked account, and contact your bank if payments may be involved. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Type or open website addresses you already trust, and look for HTTPS on sign-in and payment pages. 2
  • Treat a padlock as proof of an encrypted connection, not as proof of who owns the site. 23
  • If you run a service, follow current NCSC TLS guidance and mark cookies as secure. 1

Frequently asked questions

If a website has a padlock, does that mean it is genuine?

No. A padlock means the connection to that site is encrypted. It does not, on its own, prove the site is the organisation you have in mind. A later NCSC note on TLS points out that phishing sites use TLS too, to look more believable. 23

What is the difference between HTTPS and TLS?

HTTPS is the familiar padlock version of the web address. Under the surface it uses TLS to protect data in transit. 12

Do I need to configure TLS 1.3 at home?

No. The NCSC version advice is written for people who run servers. At home, the useful habit is to use HTTPS for email, banking and shopping, and to check the address. 12

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Using TLS to protect data | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, 'Krack' Wi-Fi guidance | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, TLS 1.3: better for individuals, harder for enterprises | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).