SSL/TLS (HTTPS)
SSL/TLS is the encryption of the connection between browser and website. It is recognisable by “https://” in the address and protects transmitted data such as form entries from being intercepted.
Technically, today’s protocol is called TLS; the older name SSL has stuck in everyday use. It is based on a certificate confirming that the connection really leads to the stated domain.
Modern browsers mark pages without HTTPS as “not secure” — which deters visitors. For every website, especially with forms, login or a shop, HTTPS is standard today.
Certificates expire after a certain time and must be renewed. Good hosting solutions do this automatically and monitor it.
What to look out for
- Serve all pages exclusively via HTTPS and redirect HTTP automatically.
- Set up automatic certificate renewal.
- Have certificate expiry monitored.
- Check that embedded images and scripts also load via HTTPS.
- Do not forget subdomains such as shop. or portal.
Common mistakes
- The certificate expires and the website shows a security warning.
- The site is reachable via HTTPS but still also unprotected via HTTP.
- Mixed content: individual elements load unencrypted.
Frequently asked questions
Not necessarily. There are free certificates that renew automatically and are entirely sufficient for most websites.
HTTPS protects the transmission, not the website itself. Updates, secure passwords, backups and monitoring remain necessary.
More in our article: Website security: the basics every business needs