Switching your website to HTTPS: the padlock explained for beginners

A small padlock next to the address, or on the contrary a red “Not secure”: it's the first thing a visitor sees of your website, even before your logo. Here is what HTTPS really does, why Google and browsers require it, how to get it — and why, on Leopar, there is nothing for you to do.

HTTP, HTTPS: the letter that changes everything

When your browser asks a server for a page, it speaks to it in a language called HTTP. In plain HTTP, everything travelling between the two — the page, a completed form, a password — goes in the clear: anyone along the way (the café's Wi-Fi, a network operator, a malicious intermediary) can read or alter it.

The S in HTTPS stands for secure: the conversation is encrypted. It remains readable for your visitor and for your server, but becomes unreadable for everyone in between. The padlock simply indicates that this encryption is active and that the server really is who it claims to be.

Why it has become mandatory, even for a brochure website

“My website only presents my business, I have nothing to hide.” True, and yet three reasons make HTTPS indispensable today:

Trust	Chrome, Safari and Firefox display “Not secure” on any HTTP website. A visitor who sees that warning closes the tab, especially before filling in a contact form.
Google	HTTPS has been a ranking factor since 2014. With equal content, a secure website comes out ahead.
Integrity	Without encryption, an intermediary can inject advertising or change your text without your knowledge. With HTTPS, the page arrives exactly as you published it.

The certificate: your website's ID card

To speak HTTPS, a server needs a certificate: a small file, issued by a recognised authority, proving that mybusiness.com really is served by the right server. Ten years ago, a certificate was expensive and had to be renewed by hand every year. Since Let's Encrypt (2016), it is free, issued in seconds and renewed automatically every three months by the server itself.

In practice, the authority checks one single thing: that the domain name really points to the server requesting the certificate. That is why a website cannot be on HTTPS before its domain name is correctly set up.

How to switch a website to HTTPS, in three steps

If you manage your own hosting, the procedure is always the same, whatever the provider:

1. Get the certificate. With most hosts, it's a checkbox in the control panel (“SSL”, “Let's Encrypt”). On a server you administer yourself, a tool such as Certbot does it in a single command.

2. Redirect HTTP to HTTPS. Without this step, your website exists in two versions and visitors who type the address without “https://” land on the unsecured one. A permanent redirect (code 301) solves the problem and avoids duplicate content for Google.

3. Hunt down “mixed content”. If your secure page loads an image or a script over “http://”, the browser removes the padlock. Every resource must be on HTTPS, including those coming from other websites.

What Leopar does for you

On Leopar, these three steps don't exist for you: HTTPS is enabled automatically as soon as your website is online, with a certificate renewed without any intervention, and the redirect from HTTP to HTTPS is in place. Your site is built to load only secure resources, so there is no mixed content to track down.

Keeping a domain already registered elsewhere? The certificate is issued as soon as your A record points to your server — it's the only line to change, and we send it to you. Until propagation is complete, your website remains visible over HTTPS on its trial address.

Frequently asked questions

Does HTTPS slow a website down?
No. The cost of encryption is negligible on a modern server, and HTTPS opens the door to faster protocols (HTTP/2, HTTP/3) that only work over a secure connection. In practice, an HTTPS website is faster.

My website is on HTTPS but the padlock doesn't show, why?
It's almost always mixed content: an image, a font or a script still loaded over “http://”. The browser console (F12) tells you which one.

Is a free certificate less secure than a paid one?
No. The encryption is identical. Paid certificates add administrative guarantees (company verification) that no longer have any visible effect in browsers.

What happens if the certificate expires?
The browser displays a full-screen warning page and most visitors turn back. That is why renewal must be automatic, never manual.