How to Check If a Website Uses HTTPS (in 5 Seconds)

October 18, 2026 • NOFYI Editorial Team

When you visit a website, the address in your browser bar usually starts with either http or https. That extra letter s stands for secure, and it means the connection between your browser and the site is encrypted. Encryption scrambles the information you send, such as a password or a form entry, so it is harder for someone on the same network to read it. Checking for https takes only a few seconds, and it is a habit worth building before you sign in, pay, or share personal details.

This guide explains how to check in five seconds, what the padlock icon means, what https does not prove, and what to do when a site does not use it. It uses only the address bar and the browser controls you already have.

What HTTPS Means in Plain Language

HTTP stands for Hypertext Transfer Protocol. It is the set of rules a browser and a website use to exchange pages and data. HTTPS adds encryption to that exchange. You can think of HTTP as sending a postcard, where anyone who handles it can read the message, and HTTPS as sending a sealed envelope, where the contents are protected while they travel. The envelope does not guarantee that the sender is honest. It only protects the message on its way.

Modern browsers show https in the address bar, often with a padlock or a similar icon. On some phones, the full address may be hidden until you tap the address bar. Tapping it reveals the full address, including the https part. That is the check you are looking for.

HTTPS is now the normal setting for most reputable websites, especially any site that asks you to sign in or pay. If a site that asks for sensitive details does not use https, that is a reason to stop and think carefully before you continue.

The 5-Second Check

First, look at the address bar before you type anything. The address should start with https, not http. If you see http, the connection is not encrypted. Do not enter a password, a card number, or personal details on that page.

Second, look for the padlock or security icon next to the address. The icon should appear calm and closed, without a warning. If the browser shows a broken padlock, a warning triangle, or a message such as Not Secure, read the warning and do not enter sensitive details.

Third, read the domain carefully. The domain is the main part of the address, such as example.com in https://example.com/login. Check that the spelling matches the site you intended to visit. Attackers can register look-alike domains that differ by one letter, use a different ending, or add extra words. A secure connection to the wrong site is still the wrong site.

Fourth, check that you are on the page you expected. If you followed a link from an email, a message, or a search result, confirm that the address matches the official site. If anything looks off, close the tab and go to the site by typing its address yourself or using a bookmark you trust.

Fifth, only then sign in or share details. If all four checks pass, you have done the basic check. It takes a few seconds once it becomes a habit, and it is worth doing every time you are about to enter sensitive information.

How to Check on a Computer and on a Phone

On a computer, the address bar is at the top of the browser window. Click it to reveal the full address if it is shortened. Look for https at the start, and look for the padlock or security icon to the left of the address. You can click the icon to see a short summary of the connection and the certificate details. The certificate is a digital document that identifies the site and confirms that the encryption is set up for that domain. You do not need to understand every field in the certificate, but you can check that it is issued for the domain you are visiting and that the browser does not report a problem with it.

On a phone, the address bar is usually at the top or bottom of the screen, depending on the browser. Tap it to reveal the full address. Look for https and the padlock icon. In some mobile browsers, the padlock may be small, and the full address may be shortened. Tapping the address or the icon usually shows more detail. If you are using an app rather than a browser, the address bar may not be visible. In that case, use the official app from a trusted app store, and do not follow links in messages to reach the sign-in screen.

In either case, if the browser warns you about a certificate, a connection, or a site being unsafe, do not ignore the warning. A warning does not always mean the site is malicious, but it does mean the browser could not verify the connection. Leave the page, and try again later through a known address or app.

Worked Example: Checking a Shopping Checkout Page

Imagine a person named Jordan who wants to buy a gift from an online shop. Jordan finds the shop through a search result, adds an item to the cart, and reaches the checkout page. Before entering payment details, Jordan runs the five-second check.

First, Jordan looks at the address bar. The address starts with https, not http. The padlock icon is present and shows no warning. So far, so good.

Next, Jordan reads the domain. The address is https://example-shop.com/checkout. Jordan checks the spelling. It matches the shop name Jordan intended to visit, and there are no extra words or odd endings. Jordan also notices that the address does not contain a long string of unrelated domains or a misspelled version of a well-known brand.

Then, Jordan clicks the padlock icon. The browser shows a short summary that the connection is secure and that the certificate is issued for example-shop.com. There is no warning about a mismatch or an expired certificate.

Jordan decides the basic check passes, but still stays careful. Jordan does not use a link from an unexpected email to reach the checkout. Jordan reached the shop through a search result, so Jordan double-checks the shop name and the return policy on the site, and uses a payment method with buyer protection. After the purchase, Jordan checks the order confirmation, which arrives from an address that matches the shop domain.

Now imagine a different case. Jordan follows a link in a message that promises a discount, and lands on a page that looks like the same shop. The address is http, not https, and the browser shows a Not Secure warning. The domain is spelled slightly differently. In that case, Jordan closes the page and does not enter any details, even though the page looks familiar. The difference between the two cases is not the design of the page. It is the address and the warning.

What the Padlock Does Not Prove

The padlock is not a trust guarantee. It means the connection is encrypted, not that the site is honest, safe, or well run. A phishing site can also use https and show a padlock. An attacker can set up a secure site that looks like a real service, and the browser will still show a padlock because the connection itself is encrypted. The padlock tells you about the connection, not about the people behind the site.

The padlock also does not prove that a site will handle your data responsibly. A site can use https and still store passwords poorly, share data in ways you would not expect, or have weak security in other areas. It also does not prove that a product is genuine, that a review is real, or that a price is fair. Those judgments need other checks, such as reading the privacy policy, checking the business details, and using a payment method you trust.

Finally, the padlock does not protect you from everything on a network. It protects the connection between your browser and the site, but it does not protect your device from malware, and it does not stop you from entering details on a fake site if you were tricked into visiting it. Treat https as a necessary check, not as a complete safety guarantee.

What to Do If a Site Does Not Use HTTPS

If a site uses http and does not ask for any sensitive details, you can still read it, but be careful about what you enter. Do not sign in, do not enter a password, and do not fill in a form with personal details. If the site should have a secure version, try changing http to https in the address bar and loading the page again. Many sites redirect automatically, and some browsers do this for you.

If the site asks for sensitive details on http, stop. Do not enter the details. Close the page, and find the official site through a search result, a bookmark, or an app you trust. If the official site also uses http for sign-in or payment, that is a strong reason to avoid using it for those tasks, and to contact the organization through another channel if you need to.

If you run a website, moving to https is a basic step. It protects your visitors, helps browsers show your site without warnings, and is expected for any site that has a sign-in, a form, or a checkout. If you are not sure how to set it up, your hosting provider or website platform usually has a guide for enabling a certificate.

Limitations

This check is quick, but it has limits. A browser may hide the full address, shorten it, or show only the domain. That can make it harder to spot a look-alike address. Tapping or clicking the address bar to reveal the full address helps, but it does not remove the need to read it carefully.

A certificate can also be valid for a domain that is not the one you intended. For example, a secure site with a similar name can still pass the https check. That is why reading the domain matters as much as seeing the padlock.

Finally, https does not protect you if your device is compromised, if you are using a network that you do not trust and you ignore browser warnings, or if you paste sensitive details into a site you reached through a suspicious link. Use https as one check in a wider habit: verify the address, avoid suspicious links, keep your browser updated, and use unique passwords with two-factor authentication where it is available.

Frequently Asked Questions

Is a site safe if it has a padlock?

Not necessarily. The padlock means the connection is encrypted. It does not mean the site is honest or that your data will be handled well. Always check the domain, and use other signs of trust, such as a known business, clear contact details, and a payment method you trust.

What does Not Secure mean?

It means the browser did not find a secure https connection for that page. The information you enter on that page could be read by others on the network. Do not enter a password, payment details, or personal information on a page marked Not Secure.

Can I trust a site that redirects from http to https?

A redirect to https is common and is usually a good sign, because it means the site prefers a secure connection. Still, check the final address and the domain after the redirect, and look for any warning. If the browser warns you, do not continue.

What if I cannot see the padlock on my phone?

Tap the address bar to reveal the full address, and look for https at the start. You can also tap the lock or information icon, if your browser shows one, to see the connection details. If you are in an app with no address bar, use the official app from a trusted app store, and do not follow links in messages to sign in.

Checking for https is a small habit with a clear payoff. Look at the address, confirm it starts with https, check the padlock, read the domain, and confirm you are on the site you intended. Remember that the padlock is not a trust guarantee. It protects the connection, while your judgment about the site itself still matters.