HTTPS and the browser lock: what it actually means

The lock in the address bar calms people more than it should. It means the browser is talking to the certificate that presented this name, and that the connection is not readable in clear text along the way. It does not check for a foreign script on the page, a weak admin password or a hole in an order.

What around the lock is still worth closing

• The certificate should not expire in silence. A person or monitoring has to see the date in advance.
• The page should not pull images and scripts over plain HTTP. A browser cuts or flags mixed content.
• The old address without HTTPS should lead to the protected one, not live as a separate site.
• HSTS makes sense after the whole plane opens stably over HTTPS, not on the first day of an experiment.

A separate pain for stores is payment and widgets that mix in unsafe resources on one step only. The homepage has the lock, checkout does not, or it shows a warning. The buyer sees the warning exactly where they are asked to pay.

Lexora checks this in technical SEO and in a short audit: the certificate, redirects, mixed content and whether the lock disappears on the most important page.