HTTPS is the reason you see a small padlock next to the address of most websites. It means the page you are reading travelled from the server to your browser inside an encrypted tunnel. Nobody on the same café Wi-Fi, no internet provider and no router in between can read or quietly change what passes through. TLS is the technology that builds that tunnel.

If you sell anything online, this concerns you directly. Your customers type their email, their home address and sometimes their card number into your pages. Browsers, payment providers and search engines all expect those pages to be served over HTTPS. A store without it looks broken to a modern browser, and in practice it cannot take payments at all.

What is HTTPS and TLS?

HTTP is the language browsers and servers use to exchange pages, images and form data. On its own, HTTP sends everything in plain text. HTTPS is the same language wrapped in TLS, short for Transport Layer Security. The "S" stands for secure.

TLS does three jobs at once:

  • Encryption. The data is scrambled so that only the browser and the server can read it.
  • Integrity. Any change made in transit is detected, so nobody can inject a fake price or a malicious script into your page on the way.
  • Authentication. The server proves it really is yourstore.com and not an impostor, using a certificate signed by a trusted authority.

You will often hear "SSL" instead of TLS. SSL (Secure Sockets Layer) was the older protocol. It was retired years ago because of security flaws, but the name stuck. When a host offers a "free SSL certificate", it actually means a TLS certificate. Today the versions in use are TLS 1.2 and TLS 1.3.

HTTPS is not a guarantee that a website is honest. A scam site can have a valid certificate and a padlock. The padlock only tells the visitor that the connection is private and that the domain is the one shown in the address bar. It says nothing about who runs the business. HTTPS also does not protect data once it reaches the server. That part depends on how the platform stores and secures it, which is where guidelines like OWASP come in.

Related vocabulary: certificate authority (the organization that signs certificates, such as Let's Encrypt), handshake (the negotiation at the start of a connection), HSTS (a rule telling browsers to always use HTTPS for a domain) and mixed content (an HTTPS page that still loads some files over plain HTTP).

Why it matters

The first reason is money. Card networks require encrypted connections wherever payment data is entered. Stripe and PayPal will not run their checkout forms on an unencrypted page. Without HTTPS, you simply have no checkout.

The second reason is trust at the exact moment people decide to pay. Chrome, Safari and Firefox label HTTP pages as "Not secure", and they show a stronger warning as soon as a visitor starts typing into a form. Many shoppers stop right there.

Here is a worked example. Say your store gets 6,000 visits a month, converts at 2% and has an average order value of $45. That is 120 orders and $5,400 in revenue. Now imagine your certificate expires on a Friday evening and nobody notices until Monday. For three days, every visitor sees a full-page browser warning. If even 80% of them turn back, you lose around 80% of three days of sales, roughly $430. On a launch weekend, when traffic is five times higher, the same mistake costs more than $2,000.

The third reason is search visibility. Google has used HTTPS as a ranking signal for years, and browsers now try the HTTPS version of a site first by default. An HTTP store starts every comparison at a disadvantage.

How it works

You never see the mechanics, but they happen in a fraction of a second every time someone opens your store:

  • The browser connects. It contacts your server and says which TLS versions and encryption methods it supports.
  • The server presents its certificate. The certificate contains your domain name, a public key and the signature of a certificate authority.
  • The browser checks the certificate. It verifies the signature against the list of authorities it trusts, confirms the domain matches the address bar and checks the expiry date. If anything fails, the visitor gets a warning page.
  • Both sides agree on a secret key. Using public key cryptography, browser and server derive a shared session key that nobody listening in can compute.
  • The data flows encrypted. Pages, form entries, cookies and images are all encrypted with that session key until the visit ends.

TLS 1.3 shortened this handshake so that a secure connection is often ready in a single round trip. The performance argument against HTTPS that people made ten years ago no longer holds. In most cases, HTTPS is also required to use HTTP/2 and HTTP/3, which make pages load faster.

Certificates expire. Free certificates from Let's Encrypt last 90 days, and the industry is moving toward even shorter lifetimes. That is why renewal has to be automatic. A human remembering to renew once a year is exactly how certificates end up expiring.

Benchmarks and examples

Today, the large majority of pages loaded in Chrome are served over HTTPS, well above 90% by Google's own reports. For an online store, the target is 100%. Every page, image, script and form should load over HTTPS, not just the checkout.

Some typical situations:

  • A creator on a hosted link-in-bio page. HTTPS is handled by the platform. The only thing to check is that shared links start with https://.
  • A small brand connecting a custom domain. The certificate has to be issued for the new domain. On a good host this takes a few minutes after the DNS records point to the platform.
  • A self-hosted store built by a freelancer. Someone has to install the certificate, set up auto-renewal, force redirects from HTTP to HTTPS and fix mixed content. Each step is a place where things can break.
  • An old site with hard-coded image links. Pages load over HTTPS but some product photos still point to http://. Browsers may block those files or remove the padlock.

A certificate costs nothing for most stores. Paid certificates with extended validation used to show the company name in a green bar, but browsers removed that display, so the extra spend rarely brings a visible benefit for a small business.

Common mistakes

  • Letting a certificate expire. It is the most common HTTPS incident, and it takes the whole store offline in the eyes of visitors.
  • Securing only the checkout. Login pages, account pages and contact forms carry personal data too. Serve the whole site over HTTPS.
  • Leaving mixed content. One image or script loaded over HTTP can break the padlock or get blocked by the browser.
  • Forgetting the redirect. If http://yourstore.com still loads without redirecting, old links and bookmarks keep sending people to the insecure version.
  • Treating the padlock as full security. HTTPS protects data in transit. Weak passwords, outdated plugins and exposed admin panels are separate problems.

Best practices

  • Automate renewal. Use a host or tool that renews certificates on its own, and set a monitoring alert that warns you 14 days before expiry just in case.
  • Redirect everything to HTTPS. Use permanent (301) redirects so both visitors and search engines land on the secure version.
  • Turn on HSTS once everything works. It tells browsers never to try plain HTTP on your domain again.
  • Cover every domain and subdomain. www, the bare domain and any shop or blog subdomain each need a valid certificate.
  • Audit for mixed content after a redesign. Open your main pages with the browser's developer tools and look for warnings.
  • Update links in your bio and emails. Point every campaign and profile link to the https:// address.

In Roctify

Roctify serves every storefront and link-in-bio page over HTTPS with a free SSL certificate. When you connect a custom domain, the certificate is issued for it and renewed automatically, so there is no expiry date for you to track. Checkout runs on the same encrypted connection, and card payments go through Stripe or PayPal, which handle card data on their side.

Because Roctify hosts and maintains the platform, TLS configuration and security updates are part of the service on every plan, including the free one. You focus on products and customers. The padlock stays on.

FAQ

Is SSL the same as TLS?

In everyday use, yes. SSL is the old name of the protocol and has not been considered safe for years. What hosts call an "SSL certificate" today is a TLS certificate, and the connection uses TLS 1.2 or 1.3.

Do I need HTTPS if I do not take card payments on my site?

Yes. Any form that collects an email, a name or an address sends personal data. Browsers mark HTTP pages as not secure, search engines prefer HTTPS and payment providers require it the day you do start selling.

Does HTTPS slow down my store?

No, not in any way a visitor would notice. Modern TLS adds very little overhead, and HTTPS unlocks faster protocols like HTTP/2 and HTTP/3. In practice, an HTTPS store usually loads faster than the same store on plain HTTP.