Why HTTPS Alone Does Not Prove a Website Is Safe
The padlock means your connection is encrypted. It does not tell you who you are talking to. Here is what HTTPS really guarantees, and what it doesn’t.
For years people were told to “look for the padlock” before shopping online. That was good advice when many sites did not encrypt traffic at all. Today almost every site — including fake ones — uses HTTPS, so the padlock no longer separates real from fake.
HTTPS is still essential. You should never enter card details on a page without it. But it is a minimum requirement, not a verdict.
What HTTPS actually does
HTTPS encrypts the connection between your browser and the server, and confirms that the server controls the domain name shown in the address bar. In practice that means:
- People on the same Wi-Fi network cannot read what you type.
- Data is protected from being altered in transit.
- The certificate was issued for the domain you see — whatever that domain is.
Why fake sites have HTTPS too
Certificates are free and automatic from several providers, which is a good thing for the web overall. Domain-validated certificates confirm that the requester controls the domain; they are not a judgment about the business behind it. Anyone who registers a domain can obtain one in minutes.
Browsers have also simplified how they show HTTPS. Some no longer show a padlock at all, instead flagging pages that are not secure. So both “padlock” and “no padlock” cues are less meaningful than they used to be.
What to check in addition to HTTPS
- Confirm the page uses HTTPS — if not, do not enter card details.
- Read the registered domain and compare it with the one on your card or paperwork.
- Think about how you arrived on the page.
- Check that the information requested matches the task.
- Watch for urgency, threats or unexpected prizes.
If your browser shows a certificate warning
A full-page certificate or security warning means the browser could not confirm the connection is safe. On a card, banking or gift-card page, that is a reason to stop — not to click “Proceed anyway”. Close the tab and reach the site again by typing the official address yourself.
Warning signs
- You are being reassured by the padlock alone.
- The browser shows a certificate or “not secure” warning on a page asking for card details.
- The page claims to be “100% secure” or shows badges you cannot verify.
Checklist
- The page uses HTTPS.
- The domain matches the official one exactly.
- I arrived from a trusted source.
- No security warnings appeared.
Common mistakes
- Treating the padlock as a trust seal
- It confirms encryption and domain control, not honesty.
- Trusting on-page “secure” badges
- Any page can display an image of a security badge. Badges are not a technical control.
- Clicking through browser warnings
- Warnings exist for good reasons. On payment pages, never proceed past them.
What to do next
- Read our guide to lookalike domains to learn how to read addresses.
- Use the website checklist before entering card details on any new site.
Questions
No. HTTPS is a minimum requirement for any page that handles card details. It just isn’t enough on its own to prove a site is legitimate.
Sources and further reading
- U.S. Federal Trade Commission — How to Recognize and Avoid Phishing Scams (opens in a new tab)
- CISA — Recognize and Report Phishing (opens in a new tab)
- UK National Cyber Security Centre — Dealing with suspicious emails and messages (opens in a new tab)
External links go to independent sources we consider authoritative. Check My Card is not responsible for their content.
This guide is general education, not financial or legal advice. For anything about your own card, contact your issuer using the number printed on your card. Spotted an error? Request a correction.
