The padlock isn’t everything: what HTTPS really means for your child’s safety

Understanding Tech

The Padlock Isn’t Everything: What HTTPS Really Means for Your Child’s Safety Online

Complete, evidence-based guidance for UK families about HTTPS, SSL certificates, padlocks, phishing, and what real website safety actually means.
Written by a family tech consultant and parent. Calm, practical, no jargon.

Your child is probably asking about the padlock icon in the browser.
Or worse — they’ve been taught that “if there’s a padlock, the site is safe.”
This is a dangerous misunderstanding that puts them at risk.

The padlock means something very specific: the connection between their device and the website is encrypted.
But it says almost nothing about whether the website itself is honest, safe, age-appropriate, or legitimate.

Scammers use HTTPS. Phishing sites use HTTPS. Malware-hosting sites use HTTPS.
The padlock is a security feature — it’s not a safety badge.

This guide explains what HTTPS actually is, why the padlock is misleading, how to spot fake sites despite the padlock, and most importantly — how to teach your child the real markers of a trustworthy website.

What HTTPS Actually Does: The Technical Explanation (In Plain Language)

Understanding HTTPS helps you explain it correctly to your child and recognize when they’re using it falsely as a safety indicator.

The Normal Internet (HTTP) vs. The Encrypted Internet (HTTPS)

Without HTTPS (HTTP):
When your child visits a website using plain HTTP, the data traveling between their device and the website is sent in plain text.
Anyone on the same Wi-Fi network, their Internet Service Provider (ISP), or anyone intercepting the connection can read:

• Everything they type (passwords, search queries, messages)
• Every file they download
• Every form they submit (logins, personal information)

This is like sending postcards through the mail — everyone who handles them can read the message.

With HTTPS (Encrypted):
When a site uses HTTPS, the data is encrypted using complex mathematical algorithms.
Only your child’s device and the website can decrypt it.
Even if someone intercepts the data, they see jumbled code, not readable information.

This is like putting postcards in a locked box — people can see the box, but can’t read what’s inside.

The Padlock Icon Explained

When a site uses HTTPS, modern browsers display a padlock icon in the address bar.
This icon simply means: “This connection is encrypted.”

To use HTTPS, a website needs an SSL (Secure Sockets Layer) certificate — a digital credential that enables encryption.
Getting an SSL certificate is:

• Quick: Can be issued in minutes
• Cheap or free: Many services offer free SSL certificates
• Automatic: Many hosting providers include it

The critical point:
An SSL certificate requires no verification of the website’s legitimacy, honesty, or purpose.
A scammer can get an SSL certificate just as easily as a legitimate business.

What HTTPS Protects

• Passwords on public Wi-Fi:
  Your child is at a café on unsecured Wi-Fi. With HTTPS, their login is encrypted. Without it, hackers on the same network could intercept it.
• Credit card information:
  HTTPS encrypts payment data so it can’t be read if intercepted.
• Personal information in forms:
  HTTPS protects data while in transit.
• ISP surveillance:
  Your ISP can see you visited a site, but HTTPS prevents them from seeing the specific pages within that site or what you submitted.

What HTTPS Does NOT Protect

• The website’s legitimacy:
  A scam site with HTTPS is still a scam. Encryption doesn’t make it honest.
• Content safety:
  A malware-hosting site can use HTTPS. The padlock doesn’t mean the site is malware-free.
• Age-appropriateness:
  Adult sites, gambling sites, and other age-restricted sites use HTTPS. The padlock doesn’t indicate content suitability for children.
• Phishing or social engineering:
  A phishing site (fake login page) can have HTTPS and a padlock. The encryption protects the data you enter — directly to the scammers.
• Malware after download:
  HTTPS protects the download, but doesn’t prevent malware on the downloaded file.
• What happens to data after it arrives:
  HTTPS protects data in transit. Once the site receives it, HTTPS is done. What the site does with the data depends on their privacy policy — which often nobody reads.

Why Scammers and Predators Love HTTPS (And Why Your Child Should Know This)

HTTPS is actually a gift to scammers because it creates false confidence.
Parents and children who think “padlock = safe” let their guard down completely.

The Phishing Attack: A Real Example

Your child receives a text: “Click here to verify your Roblox account before it’s suspended”

The link goes to a website that looks exactly like Roblox login page.
It has:

• ✓ HTTPS and a padlock icon
• ✓ The Roblox logo
• ✓ Identical layout and styling
• ✓ The correct color scheme

But the domain is slightly different: de>robloz-security.com instead of de>roblox.com

Your child enters their username and password. The site says “Account verified!” and redirects to the real Roblox site.
They think nothing happened.
But the scammers now have their login credentials.

The padlock didn’t protect them because it was never supposed to.
The padlock just ensured their credentials were encrypted directly to the scammers.

Common Phishing Tactics Using HTTPS

Why These Work Against HTTPS-Educated Children

If your child has been taught “padlock = safe,” they see the padlock and stop thinking critically.
They don’t notice the domain is slightly wrong because the padlock makes them trust it.

Real website safety requires checking:

• The exact domain name (not trusting visual similarity)
• Whether the site is asking for something it shouldn’t
• Whether the timing and request feel legitimate
• The reputation of the site (not just the padlock)

How to Spot a Legitimate Website (Padlock or Not)

Real website trust comes from multiple factors working together, not from a single padlock icon.

The Real Markers of a Trustworthy Website

A Practical Framework: The “STOP and Think” Method

Teach your child to stop before entering information on any website:

Real-World Scenarios: How to Teach Your Child

Scenario 1: Gaming Site Login

What happens:
Your child is playing Fortnite. They get a message: “Your account has unusual activity. Click here to verify.”
They click. The site has:

• ✓ HTTPS and padlock
• ✓ Fortnite logo
• ✓ Official-looking layout

But the domain is: fortnite-verify-account.com

What to teach:
“If you’re in the middle of playing a game and suddenly get a message, stop. Go to your browser and type the real site address yourself. Fortnite won’t ask you to verify in the middle of a game. That’s a scam.”

Scenario 2: School Login

What happens:
Your child receives an email: “School has moved learning platform. Click here to access.”
The site looks like the school’s login page. Has HTTPS. Looks official.

But the domain is: schoolname-learning.net instead of schoolname.ac.uk

What to teach:
“If the school sends you a login link, always ask: Is this the exact address I use normally? Never click a link in an email for login. Go directly to the site yourself. The padlock won’t save you if you’re entering your password into a fake site.”

Scenario 3: Free Game Download

What happens:
Your child finds a site offering free Robux (Roblox currency).
Site has HTTPS, reviews, looks legitimate.

What’s actually happening:
Malware or data harvesting. The padlock means the connection is secure — but the site itself is harmful.

What to teach:
“Free currency or games from random sites is always a trap. The padlock doesn’t tell you if a site has malware. If it sounds too good to be true, it is.”

Age-Specific Guidance: What to Focus On at Each Stage

Tools and Settings That Actually Help

Browser-Level Protection

• Chrome, Firefox, Safari built-in phishing alerts:
  Modern browsers flag known phishing sites before they load.
  Enable this by default (usually on by default).
• Google Safe Browsing:
  Chrome and Firefox use this to warn about malware and phishing sites.
  Make sure it’s enabled in settings.

Home Network Protection

• SafeSearch on Google, Bing, YouTube:
  Reduces (not eliminates) explicit results. Enable on all devices at home.
  Google: google.com/safesearch → Lock SafeSearch
  YouTube: Settings → Restricted Mode
• DNS filters (OpenDNS Family, CleanBrowsing, Quad9):
  Works at the router level to block known malicious domains before connection happens.
  More robust than individual browser settings.
• Router parental controls:
  Many routers allow scheduling (no internet after bedtime), category filtering (block gambling, adult sites), and monitoring.

Device-Level Protection

• Windows Defender (built into Windows):
  Provides basic malware and phishing protection. Keep it on.
• macOS Gatekeeper (built into Mac):
  Prevents installation of unsigned or unverified applications.
• iOS App Store review:
  All apps are reviewed before listing, reducing malware risk (though not eliminating it).
• Android Google Play Protect:
  Scans apps for malware. Less comprehensive than iOS but still useful.

Habits That Protect More Than Any Tool

• Use bookmarks for important logins:
  Instead of searching or clicking links, bookmark sites you log into (school, email, banking).
  Access via bookmark only.
• Avoid clicking links in messages:
  This is the #1 phishing vector. Teach: “Never click a link in an email, text, or message. Go to the site directly.”
• Pause before entering passwords:
  Before login, check: Is this the exact site I use normally? Am I here because I searched for it, or because someone sent me a link?
• Review privacy policies (occasionally):
  Legit sites have clear privacy policies. Scam sites often don’t. It doesn’t require reading the whole thing — just check one exists.
• Check for contact information:
  Real sites have contact info (email, address). Scam sites often don’t.

What to Do If Your Child Falls for a Phishing Scam

If your child has entered a password, email, or payment information on a phishing site:

1. Don’t panic or blame them.
   Phishing is sophisticated. Many adults fall for it. Blame creates shame and prevents them telling you next time.
2. Ask what information was entered:
   Passwords? Email? Payment details? Personal information?
3. Immediately change the password:
   Go directly to the real site (bookmark, not link) and change the password to something completely new.
   Use a password manager to create a strong, unique password.
4. Enable two-factor authentication (2FA):
   If the compromised account offers 2FA (email, SMS, or authenticator app confirmation), enable it immediately.
   This prevents login even if the password is compromised.
5. Monitor for suspicious activity:
   Check the account for unauthorized access, purchases, or changes.
6. Report the phishing site:
   Most platforms have reporting tools. Report to:
   – Google Safe Browsing (for browser alerts)
   – The platform that was impersonated (e.g., Roblox, school, bank)
   – Action Fraud (if money or financial details were compromised)
7. Review the lesson together (not as punishment):
   “What did the site do to make you trust it? What could have been a red flag? How will you check next time?”
   This prevents repetition without shame.

Common Myths About HTTPS and Padlocks (What to Correct)

The Real Conversation to Have With Your Child

Follow up with:

“Before you enter a password or personal information anywhere online, stop and think:
Where am I? Is this the exact site I use normally? Would this site really be asking me this right now?
When in doubt, ask me. I’d rather answer 100 questions than have you enter information into a fake site.”

A Parent’s Quick Checklist

• ☐ Explain what the padlock means (connection encrypted) and what it doesn’t (site is safe or legitimate)
• ☐ Show your child where the address bar is and why checking the domain matters more than seeing a padlock
• ☐ Create bookmarks for sites your child logs into (school, email, YouTube, gaming accounts)
• ☐ Enable SafeSearch on Google, Bing, and YouTube on every device
• ☐ Consider a DNS filter at the router level (OpenDNS Family, CleanBrowsing, Quad9)
• ☐ Teach the “STOP and Think” framework for evaluating sites
• ☐ Role-play phishing scenarios: “This text says your Roblox account is locked. What do you do?”
• ☐ Make clear: Never click links in messages or emails. Always go to the site directly.
• ☐ Enable two-factor authentication on important accounts (email, gaming, school logins)
• ☐ Make it safe to tell you if they’ve made a mistake online (no punishment for honesty)

Where to Get Help: UK Support Services

• Get Safe Online
  — Practical cyber advice, phishing guides, and security tips for families.
• NCSC: Phishing and Scams
  — UK National Cyber Security Centre guide to recognizing and reporting phishing.
• Action Fraud
  — Report phishing, scams, and online fraud. Official UK reporting channel.
• CEOP Safety Centre
  — Report online child exploitation or abuse.
• Internet Matters
  — Practical guides on online safety, phishing, and age-appropriate browsing.
• UK Safer Internet Centre
  — Resources, reporting tools, and guides tailored to UK families.

Download the Complete HTTPS and Padlock Guide (Printable PDF)

This printable resource includes:

• Visual guide to the padlock and what it means
• Common phishing red flags and how to spot them
• Step-by-step conversation starters for different ages
• Bookmarking guide for important sites
• Quick checklist of safety settings for devices and browsers
• What to do if you fall for a phishing scam
• Space to write your family’s online safety agreement

Download “The Padlock Isn’t Everything” (PDF)

At Understanding Tech, we’re parents first and tech people second.
We test settings, translate jargon, and share what actually works at home.
The padlock is just a tool — real safety comes from understanding, critical thinking, and keeping communication open with your child.