HTTPS and certificates in plain words

The padlock means your connection to that site is encrypted and the server proved its identity with a certificate — nothing more. It says nothing about whether the site itself is honest; phishers serve HTTPS too. Read it as «nobody on this Wi-Fi can eavesdrop», not as «this site is safe».

A certificate warning is a stop sign, not a suggestion: expired, mismatched-name or self-signed certificates on public sites mean someone may sit in the middle. Never click through on banking, mail or anything with a password. On your own server, free automated certificates removed the last excuse for plain HTTP years ago.

HSTS and why it matters

The first visit to a site can still be downgraded to HTTP by an attacker on the wire — unless the site sends a Strict-Transport- Security header telling browsers to refuse plain HTTP for months ahead. If you run a site, enable HSTS after confirming HTTPS works everywhere including subdomains; if you only browse, know that the padlock on first visit to unknown Wi-Fi is weaker than it looks.

Local development trap

Developers click through certificate warnings on localhost daily and train the exact reflex attackers need. Use a local CA (mkcert takes two minutes) so even development serves valid HTTPS — your fingers should never learn that warnings are routine.