The padlock in the address bar means the connection is encrypted — nobody between visitor and site can read the forms, passwords or card details in transit. Without it, browsers literally print “Not secure” next to your name. That label costs trust that no design buys back.
What HTTPS is (and isn’t)
It secures the connection, not the site — a phishing page can carry a padlock. But its absence is disqualifying: Google uses HTTPS as a ranking signal, browsers block features (payments, location) on insecure pages, and visitors have learned to leave.
The good news: it’s basically free
Certificates that once cost hundreds are now free (Let’s Encrypt) and auto-renewed by any decent host. The real work is migration hygiene: every internal link, image and redirect moved to https://, old URLs 301-redirected, and no “mixed content” warnings from stray http images.
If your site still shows the warning — or the padlock breaks on some pages — that’s an afternoon of fixes, not a project. Send us the URL; we’ll check every page’s padlock in one pass.
Frequently Asked Questions
The connection is encrypted — forms and payments can't be read in transit; it doesn't vouch for the site itself.
Yes — it's a confirmed ranking signal, and 'Not secure' labels raise bounce before ranking even matters.
No longer — Let's Encrypt certificates are free and auto-renew on any decent host.
Secure pages loading insecure images or scripts — it breaks the padlock and needs cleanup after migration.
Yes — phishing sites use padlocks too; HTTPS is necessary, not sufficient.
Ask your host to enable a free certificate, then fix internal links and redirects — an afternoon, not a project.
Czech 
English