What HTTPS does and does not prove
Use connection warnings correctly while checking the domain and publisher separately.
Follow the method ↓
The answer in 30 seconds
HTTPS protects traffic between your browser and the domain shown. A fraudulent site can also use HTTPS, so a secure connection alone does not establish the seller's identity or the truth of its content.
Check the complete domain and the browser's connection state, then verify who runs the service and why it asks for information. Stop at a certificate warning during a sensitive task.
Examples to adapt
HTTPS protects transit but does not establish delivery, returns or the seller's identity.
Do not add an exception reflexively; check the address, device clock and service through another channel.
Open the known app or saved address instead of trusting the linked page's lock icon.
Follow the method
- 1Read the domain
Inspect the actual website name and ending, including misleading subdomains or altered letters.
- 2Check the connection
Look for HTTPS without a browser certificate warning; do not bypass a warning for payment or sign-in.
- 3Identify the request
Ask why the page wants a password, payment card or document at this moment.
- 4Confirm the publisher
Use a known address and consistent contact details for important services.
- 5Respond to warnings
Pause and verify independently rather than following instructions on the suspect page.
A checklist to keep
Use these checks to record what you found. The grid supports a decision; it does not make one for you.
| Check | What to examine | Action |
|---|---|---|
| Domain | Does the full website name match? | Read |
| Connection | Is there a certificate warning? | Stop if warned |
| Publisher | Who operates the service? | Confirm |
| Request | Why is sensitive data needed? | Question |
| Alternative | Can you open the service directly? | Use |
Read the checklist directly in the table.
What to check
A valid certificate does not certify the honesty of a website.
The expected brand name at the beginning of a long address may be only a subdomain.
An unexpected verification code should not be shared because a page uses HTTPS.
Common questions
Does a lock icon mean a site is official?
No. It describes the browser's connection to the displayed domain.
Can I ignore a certificate error?
Avoid doing so for a sensitive action; verify the service through a known route.
Sources and documentation
Documentation consulted on . Examples are illustrative; interfaces and results may change.
HTTPS protects a connection, not a commercial promise
HTTPS encrypts the connection to the requested server. It does not validate an offer, product or business identity claimed in page text.
- Read the server name
- Find the known channel
- Examine the requested action
| Situation | What changes | Useful check |
|---|---|---|
| Encrypted connection | Data is protected in transit. | Also check the domain and purpose of the request. |
| Familiar name in the path | A path can name a different organisation. | In https://example.invalid/bank, the server remains example.invalid. |
| Link received in a message | Link text can hide a different destination. | For a sensitive task, start from a known bookmark or official website. |
The .invalid address is a fictional example. The portal’s address reader parses syntax without visiting the site, so it cannot inspect redirects or actual content.
Documentation : Mozilla — HTTPS-Only Mode ↗ · · Read the reference record →