A widely misunderstood symbol.
WHAT IT MEANS
The connection between your browser and that server is encrypted, and the certificate presented is valid, current and issued for that hostname by a trusted authority.
WHAT IT DOES NOT MEAN
That the site is trustworthy That the business behind it is legitimate That your data is safe once it arrives That the site is free of malware That the company is who they claim to be
WHY THIS MATTERS
A great many phishing sites have valid certificates, because a free domain-validated certificate is available to anyone who controls a domain, including attackers who registered a lookalike domain an hour ago.
The padlock proves the connection is private. It says nothing about who is at the other end.
WHAT TO TELL CUSTOMERS
Encourage them to check the domain name itself, not only the padlock. A padlock on yourdornain.com is as green as one on yourdomain.com.
FOR YOUR OWN SITE
The padlock is necessary but not sufficient. Keep software updated, secure accounts, and protect data properly.
