Security Headers: Small Rules, Real Protection
Continue through the next layer of the domain-to-browser path.
Read the guide →Plain-English security
What does an HTTPS certificate actually protect?
An HTTPS certificate (also called a TLS or SSL certificate) does two jobs: it encrypts everything between your visitor's browser and your website so nobody in between can read or alter it, and it proves the site they reached is really yours. When it's missing or expired, browsers show a full-page warning that stops most visitors cold.
What it protects, in real terms
Every time someone fills out your contact form, types a password, or just reads your prices, that information travels across networks you don't control — coffee-shop Wi-Fi, hotel routers, their phone carrier. The certificate is what turns that traffic into unreadable ciphertext. Without it, anyone on the same network can read the form your customer just submitted.
The second job matters just as much: the certificate ties the padlock to your actual domain. It's what stops an attacker on a public network from quietly serving visitors a fake copy of your site that harvests whatever they type.
How this actually goes wrong for small businesses
Almost never by choice. The certificate was set up once, years ago, by whoever built the site — and certificates expire. When a renewal fails silently, every visitor gets a full-page browser warning that your site is not secure, and most of them leave without telling you. A business can run for days like this, wondering why the phone stopped ringing.
The industry is also shortening certificate lifetimes year over year, which turns manual renewal into a treadmill. The fix isn't remembering harder — it's automation that renews with no human in the loop, and monitoring that notices if the automation ever breaks.
Related: HSTS, the “always encrypted” rule
A valid certificate protects visits that arrive over HTTPS. A companion setting called HSTS tells browsers to never load your site over an insecure connection at all — even if someone types the address bare, even on a hostile network. The scan checks both, because a site with a good certificate and no HSTS still leaves the very first visit open to downgrade.
Check your own site in 30 seconds
The free WolfWarden scan reads this — plus seven other fundamentals — from public information and grades it in plain English. Nothing to install. Ordinary results may be cached briefly to prevent abuse; no lasting report is created unless you choose to share one.
Run the free scanCommon questions
Is SSL the same thing as TLS?
Effectively yes. SSL is the old name; TLS is the modern protocol that replaced it. People still say “SSL certificate” out of habit — same padlock, same job.
My site shows the padlock. Am I done?
The padlock means encryption is on right now. It doesn't tell you when the certificate expires, whether renewal is automated, or whether browsers are told to always use the secure version (HSTS) — which is what the scan checks.
Do I need to pay for a certificate?
For a standard business site, no. Free automated certificates from providers like Let's Encrypt or your CDN are cryptographically identical to paid ones, which mostly add insurance warranties and validation paperwork most small businesses don't need.
If you'd rather not manage this
The relevant service page explains what WolfWarden can handle, what the public scan cannot see, and where a managed plan or focused project fits.