What Is SSL/TLS? A Plain-English Guide
SSL/TLS is the technology that turns http:// into https://. It scrambles the data travelling between a visitor’s browser and your server so that nobody in between can read or tamper with it. That little padlock in the address bar is its visible sign.
The short version
SSL/TLS encrypts the connection between browser and server, proves your site is who it claims to be, and stops attackers from reading or altering traffic. Every modern site needs it — browsers now mark plain HTTP pages as “Not secure.” You can inspect any site’s certificate and protocol with our SSL checker.
SSL vs TLS: what’s the difference?
They’re the same idea, one generation apart. SSL (Secure Sockets Layer) was the original protocol from the 1990s. It was replaced by TLS (Transport Layer Security), which is what every secure site actually uses today. The old SSL versions are obsolete and insecure, but the name stuck — so when people say “SSL certificate” they almost always mean a TLS certificate. In this guide we use SSL/TLS to mean the modern, secure version.
What problem does it solve?
Without encryption, everything you send over the web travels as plain text. Anyone sharing the network — a coffee-shop Wi-Fi snooper, a compromised router, an internet provider — can read it. That includes passwords, credit-card numbers, session cookies and private messages. They could also silently rewrite the page, injecting ads or malware. SSL/TLS closes both doors: it makes the traffic unreadable to outsiders and detectable if anyone tries to change it.
How the encryption works
SSL/TLS combines two kinds of cryptography. When your browser first connects, it uses asymmetric (public-key) cryptography to safely agree on a shared secret. Once that secret is established, both sides switch to fast symmetric encryption for the actual page data. This exchange is called the handshake.
- The browser asks the server for a secure connection.
- The server presents its SSL/TLS certificate, which contains its public key.
- The browser verifies the certificate was issued by a trusted authority and matches the domain.
- Both sides derive a shared session key and start encrypting everything.
The modern version of this handshake is faster and safer than ever — see our TLS 1.3 guide for what changed.
What the padlock actually proves
The padlock tells you two things: the connection is encrypted, and the certificate is valid and matches the domain you’re visiting. That’s important, but it’s also worth knowing what it does not prove. The padlock does not mean the site is honest, safe, or run by a real business — a phishing site can get a free certificate too. It only guarantees that your connection to that domain is private.
Certificates and trust
A certificate is a signed digital document that binds your domain name to a cryptographic key. It’s issued by a Certificate Authority (CA) — an organisation browsers already trust. When your browser sees a certificate signed by a recognised CA, it accepts it automatically. If the certificate is expired, self-signed, or issued for the wrong domain, the browser throws a warning. Certificates come in a few validation levels; our certificate types guide compares DV, OV and EV.
Why HTTPS is now mandatory
HTTPS used to be reserved for login and checkout pages. That era is over. Today browsers label any plain-HTTP page as “Not secure,” search engines favour HTTPS, and modern browser features (from geolocation to service workers) simply refuse to run without it. Getting a certificate is also free and automatic now, so there’s no reason to run without one — see Let’s Encrypt vs paid SSL.
| Aspect | HTTP (plain) | HTTPS (SSL/TLS) |
|---|---|---|
| Data in transit | Readable by anyone | Encrypted |
| Tampering | Undetectable | Detected and blocked |
| Browser label | “Not secure” | Padlock |
| SEO & modern features | Penalised / blocked | Supported |
Getting it right
Having a certificate is step one. You also need to redirect all HTTP traffic to HTTPS, avoid mixed content, keep the certificate from expiring, and enable security headers like HSTS. You can confirm the whole setup at once by running a free scan.
Frequently asked questions
Is SSL the same as HTTPS?
Not quite. SSL/TLS is the encryption protocol; HTTPS is HTTP running over that encrypted connection. You need an SSL/TLS certificate to serve a site over HTTPS.
Does a padlock mean a site is safe to trust?
No. The padlock only means your connection to that domain is encrypted and the certificate matches. Scammers can obtain certificates too, so always verify the domain name itself.
How can I check a site’s SSL/TLS setup?
Use our free SSL certificate checker. It shows the certificate details, expiry date, protocol version and whether the configuration is healthy.
Related guides
TLS 1.3 Explained: What Changed and Why It Matters
A clear breakdown of TLS 1.3 — faster handshakes, forward secrecy, and how to check whether your site supports it.
Read →SSL / TLS & EncryptionSSL Certificate Types: DV, OV and EV Compared
Domain, Organization and Extended Validation certificates compared — which one your site actually needs.
Read →SSL / TLS & EncryptionLet's Encrypt vs Paid SSL Certificates
When free Let's Encrypt certificates are enough and when a paid or organization-validated certificate is worth it.
Read →Check your site against this guide
Run a free ScanOpsPro scan and see how your site handles the fundamentals.
Run a free scan