No. The padlock proves one thing: the connection between browser and server is encrypted. That is the floor now, not an achievement. 97.3% of mobile homepages serve HTTPS, across 15,426,398 mobile sites crawled in July 2025 (Web Almanac, 2025).
Does the padlock mean your website is secure?
It means the traffic is encrypted in transit. It says nothing about the software on your server, who else loads code on the page, or whether the certificate is still valid next quarter.
The padlock means the browser and the server agreed on TLS. Over 98.8% of mobile requests now travel over HTTPS (Web Almanac, 2025).
The same page can be served over HTTPS and still announce an unpatched runtime in a response header.
Encryption says nothing about who else loads scripts there. See who else is collecting data on your website.
Certificates expire. Let’s Encrypt issues for 90 days by default and recommends renewing every 60 (issuer policy, 2026).
What does an HTTPS certificate cost?
For most of the measured web, nothing. 52.6% of mobile pages carry a Let’s Encrypt certificate, down from 56% in the previous edition, and the issuer describes its own certificates as free TLS certificates from a nonprofit.
Web Almanac, 2025 · certificates per issuer, mobile · R10, R11, E5 and E6 are Let’s Encrypt intermediates, not separate companies
View data
| Item | Value |
|---|---|
| R11, Let’s Encrypt | 21.86% |
| R10, Let’s Encrypt | 21.73% |
| WE1, Google Trust Services | 17.24% |
| E6, Let’s Encrypt | 4.65% |
| E5, Let’s Encrypt | 4.42% |
| Sectigo RSA DV | 3.52% |
| Go Daddy G2 | 1.6% |
Can the padlock break on its own?
Yes, by expiring. Let’s Encrypt issues for 90 days by default, recommends renewing at 60, and states there is no way to adjust that lifetime and no exceptions.
Let’s Encrypt, 2026 · issuer policy, not a measurement of the web
View data
| Step | Value |
|---|---|
| Issued | Day 0 (valid for 90 days) |
| Renew | Day 60 (the issuer’s own recommendation) |
| Expires | Day 90 (no adjustments, no exceptions) |
| Not valid | Day 91 (unless renewal already ran on its own) |
Does the padlock protect the first visit?
On its own, no. Without the HSTS header a browser can try HTTP first and follow the redirect, and 36% of pages visited on mobile send that header (Web Almanac, 2025).
- 01It tells the browser to stay on HTTPSThe header carries a max-age. 96% of the responses that send HSTS set a valid one (Web Almanac, 2025).
- 02It sets how long that lastsThe median max-age is 365 days, and the 10th percentile rose from 30 days to 91 days in a year (Web Almanac, 2025).
- 03Two directives stay optionalThe figure reports roughly 40% covering subdomains and about 22% using preload, which is what covers the very first visit. That figure does not declare its base.
Does the padlock say your site is up to date?
No, and plenty of servers announce the opposite out loud. `Server` shows up on 91.5% of hosts on the web and `X-Powered-By` on 23.9%, and over 27% of those `X-Powered-By` headers carry a version number.
Web Almanac, 2025 · share of X-Powered-By headers, mobile, not share of sites
View data
| Item | Value |
|---|---|
| PHP/7.4.33 | 9.98% |
| PHP/7.3.33 | 4.29% |
| PHP/5.3.3 | 2.2% |
| PHP/5.6.40 | 2.12% |
| PHP/8.0.30 | 1.7% |
Hiding it is security by obscurity, which the chapter itself calls a tactic that is generally frowned upon (Web Almanac, 2025).
PHP 7.4.33 shipped November 3, 2022, and the project’s rule gives branches before 8.1 three years of security support from the initial release.
PHP 7.4.0 shipped November 28, 2019, so the branch left security support on November 28, 2022. That addition is ours, on the project’s published rule.
The chapter notes many web technologies set these headers automatically, and owners have little reason to strip them (Web Almanac, 2025).
Who actually sets this, you or your platform?
Almost always the platform, and almost always just the padlock. Everything past HTTPS is far rarer outside the most popular sites, and the automated check scores it at zero.
Web Almanac, 2025 · sites by popularity rank, mobile
View data
| Item | Value |
|---|---|
| Top 1,000 sites | 67% |
| All sites the browser visits | 30% |
GoDaddy Website Builder sends `Strict-Transport-Security` and `Content-Security-Policy` on 95.97% of its sites (Web Almanac, 2025).
`X-Frame-Options` is on 67% of the top 1,000 mobile sites and on 30% of all sites the browser visits (Web Almanac, 2025).
In Lighthouse 13.5.0, `is-on-https` carries weight 5 while `has-hsts`, `csp-xss`, `clickjacking-mitigation`, `origin-isolation` and `trusted-types-xss` all carry weight 0 (engine config, not a measurement).
Weight 5 out of the 27 points in Best Practices, by our addition of the weights in that config. See what a website audit actually checks.
The padlock is a starting line. 2.7% of mobile homepages still lack it, by our subtraction from the Web Almanac’s 97.3%. The better questions are what renews the certificate, and what else runs on the page.
Questions owners ask
Does the padlock mean my website is secure?
No. It means the connection between browser and server is encrypted. It says nothing about the software on the server, who else loads code on the page, or whether the certificate will still be valid next quarter.
How much does an SSL certificate cost?
For most of the measured web, nothing. 52.6% of mobile pages carry a Let’s Encrypt certificate (Web Almanac, 2025), and Let’s Encrypt describes its own certificates as free TLS certificates from a nonprofit.
Why did my padlock disappear?
The likeliest answer is expiry. Let’s Encrypt’s default certificate is valid for 90 days and the issuer recommends renewing every 60; the lifetime drops to 64 days on February 10, 2027. Renewal has to run on its own.
Someone found a bug on my site. Where do they report it?
Most sites have no answer. 1.72% of mobile sites publish a security.txt with contact details, and at least a quarter of those files are not fully valid (Web Almanac, 2025).
Sources
- Web Almanac 2025, Security chapter, HTTP Archive (crawl of July 1, 2025: 16,213,084 sites, 15,426,398 of them mobile; read October 26, 2026) (2025)
- Let's Encrypt, FAQ and Upcoming Features (issuer policy, not a measurement of the web) (2026)
- PHP project, release dates and branch support policy (project rules, not a measurement) (2022)
- Lighthouse 13.5.0, Best Practices category configuration (audit engine config, not a measurement) (2025)
The first meeting starts with findings, not promises.The free Business Health Report reads your business and shows you what it found, in days.
Get Your Free Business Health Report