Somewhere between 2014 and 2020, the internet collectively agreed on a piece of folk wisdom: look for the padlock. If the little lock icon is in the address bar, the site is safe. If it’s not, run.
That advice was true enough in 2014 to be useful. In 2026 it’s actively misleading. Studies from the Anti-Phishing Working Group have shown that the majority of phishing sites for several years running now carry valid SSL certificates. The padlock has become the scammer’s favorite trust signal — because they get it for free and the user trusts it for free.
This piece explains what the padlock actually proves, what it doesn’t, and what to check instead before you enter a card number.
What the padlock actually means
The padlock proves exactly three things:
- The connection is encrypted. Nobody between you and the server can read what you’re sending. Your card number won’t be intercepted on the network.
- The server’s identity hasn’t been hijacked. The site you’re connected to actually controls the domain in the URL. A man-in-the-middle attack can’t silently swap pages on you.
- The certificate was issued by a trusted authority. Some entity — your browser’s trust store agrees with this — vouched that whoever owns the domain proved they owned it.
That’s the whole list. Notice what’s missing:
- The padlock does not say the site is honest.
- The padlock does not say the operator is a real business.
- The padlock does not say the page won’t steal your money.
- The padlock does not even say the site isn’t actively phishing right now.
How free SSL changed the game
Until 2015, SSL certificates cost money. The barrier was small — usually $10–50 a year — but small enough that the average phishing operator running 20 domains decided it wasn’t worth it. Phishing sites were predominantly HTTP. The padlock heuristic worked because it correlated with operators who’d at least bothered to spend money on infrastructure.
Let’s Encrypt launched in late 2015 and changed this overnight. Free, automated, valid for 90 days, renewable forever. Wonderful for the open web. Also wonderful for phishing. By 2018, the majority of phishing domains had Let’s Encrypt certificates. The padlock heuristic stopped being a useful signal — and yet most internet safety advice never updated.
Today every meaningful certificate authority offers free or near-free DV (domain-validated) certificates. A scammer can spin up a fully HTTPS phishing site, including the padlock, in under fifteen minutes. The bar is gone.
DV vs OV vs EV certificates
Not all certificates require the same level of proof. There are three tiers, and the difference matters.
- DV (Domain Validation). The CA verifies one thing: you control the domain. A scammer who bought
flipkart-deals.shopcan get a DV cert for it in minutes. Let’s Encrypt, ZeroSSL, and most free CAs only issue DV. - OV (Organization Validation). The CA verifies that a real registered business owns the domain. Requires paperwork — business registration, phone verification, sometimes a physical address check. Takes days, costs ~$50–150/year. Real e-commerce often uses OV.
- EV (Extended Validation). The strictest tier. CA performs detailed background checks on the business — legal existence, operational presence, identity of the requester. Costs $200+/year and takes a week or more. Banks and large financial institutions still use EV.
The catch: browsers no longer visually distinguish between these three tiers. Chrome stopped showing the green “Trusted” bar for EV certs in 2019. Firefox followed. Today, a $0 Let’s Encrypt cert and a $300 EV cert from DigiCert show the exact same padlock icon.
You have to click into the certificate details to see which kind it is — and almost no user ever does.
What to check beyond the padlock
If the padlock no longer works as a single-bit safety check, what should you actually look at? Three things, fast:
- The certificate issuer. A Let’s Encrypt or ZeroSSL cert on a site claiming to be a major retailer is a red flag. Real retailers usually pay for OV/EV from a paid CA — Sectigo, DigiCert, GlobalSign, Entrust.
- The certificate’s issue date vs the domain’s age. A certificate issued three days ago, on a domain registered last week, on a site asking for card details, is a scam pattern on autopilot. Match the timeline against the brand it claims to be.
- The certificate’s Subject Alternative Names (SANs). A real company’s cert usually covers a sensible list of related subdomains. A scam cert often covers wildly unrelated domains because the same CA bundle was reused across many fake sites.
Why browsers stopped showing the green bar
A small history lesson, because it explains the current state of things. Until about 2019, EV certificates triggered a green address bar with the company’s name displayed prominently — PayPal, Inc. (US) right next to the URL. The visual was supposed to say, this is the real PayPal.
Research over several years showed the same uncomfortable thing again and again: users didn’t notice the green bar. They didn’t notice when it was missing. Scammers worked around it with shell companies and similar-sounding names. The signal was strong in theory and almost useless in practice.
Chrome and Firefox both decided the green bar was creating false confidence without measurable improvement in safety. They removed it. The downside is that EV certificates now have almost no visible signal — but the upside is that the padlock, finally, doesn’t pretend to mean more than it does.
FAQ
If I see HTTPS, is the website safe?
No. HTTPS only means the connection is encrypted and the certificate is valid. It says nothing about whether the operator is trustworthy. The majority of phishing sites in 2026 use HTTPS.
Should I worry about a site without HTTPS?
Yes — but for a different reason than people think. HTTP-only sites in 2026 are rare and usually indicate either neglect (the operator hasn’t kept up with basic web hygiene) or an old, abandoned page. Don’t enter sensitive data on HTTP, but don’t treat HTTPS as the opposite.
How can I tell what kind of SSL certificate a site has?
Click the padlock in your browser and view the certificate details. Look for “Organization” in the subject — if it’s populated, you’re looking at OV or EV. If only the domain is listed, it’s a DV certificate, which means the CA didn’t verify the business behind it.
Is Let’s Encrypt bad?
Not at all. Let’s Encrypt is a public good that secured millions of websites that would otherwise still be on HTTP. The problem is using presence of Let’s Encrypt as a trust signal. It proves the operator could pass a domain-control check and run a renewal script. Nothing more.