Let's start with the padlock

Open any website in your browser. Look at the address bar at the top. If the site is secure, you'll see a padlock icon — usually a small closed lock — just before the web address. That padlock means TLS is active.

If there's no padlock, or you see a warning that says "Not secure", TLS is not active. And that's a problem — both for visitors to your site and for your business's credibility.

But what is TLS, exactly? Let's break it down.

The Simple Analogy

Think of TLS like a tamper-proof, sealed envelope. When you send a letter without an envelope, anyone handling it at the post office can read it. TLS seals your letter inside an envelope that only the recipient can open — and if anyone tampers with it along the way, both you and the recipient will know.

So what does TLS stand for?

TLS stands for Transport Layer Security. It's a protocol — a set of agreed rules — that scrambles information sent between your browser and a website's server, so that nobody in the middle can read it.

You may also have heard of SSL (Secure Sockets Layer). SSL was the older version of the same technology. TLS replaced SSL back in 1999 and has been updated several times since. When people say "SSL certificate" today, they almost always mean a TLS certificate — the terms are used interchangeably, even though technically SSL is the old name.

Quick Fact

HTTPS — that prefix you see on secure websites — stands for HTTP Secure. The "S" is TLS doing its job. No TLS = no HTTPS = no padlock.

How does TLS actually work?

When your browser connects to a secure website, TLS kicks off a process called a handshake. It happens in milliseconds and you never see it — but here's what's going on:

  1. 1
    Your browser says hello

    Your browser contacts the website's server and says, in effect: "Hi, I'd like to connect securely. Here are the encryption methods I support."

  2. 2
    The server shows its certificate

    The website responds with its TLS certificate — a digital ID card issued by a trusted authority (called a Certificate Authority). This proves the server is who it claims to be, not an imposter.

  3. 3
    They agree on a secret key

    Using some clever mathematics (public key cryptography), your browser and the server privately agree on a unique encryption key that only the two of them know. Nobody watching the connection can figure out this key.

  4. 4
    Everything is now encrypted

    From this point on, all data sent between your browser and the server is scrambled using that private key. Even if someone intercepts the data, it looks like random noise — completely unreadable without the key.

Another way to think about it

Imagine two people agreeing on a secret language in public — but in a way where nobody watching can learn the language. Once they agree, they speak freely in that language and only they understand each other. That's essentially what the TLS handshake does.

Why does this matter for your business?

A few very practical reasons:

1. Google penalises sites without it. Google marks sites without HTTPS as "Not secure" in Chrome, and actively ranks secure sites higher in search results. No TLS = lower visibility.

2. Visitors don't trust unsecured sites. Studies show that over 80% of users will leave a website if they see a "Not secure" warning. For a business website, that's leads walking out the door.

3. It protects your customers. If someone fills in your contact form, or submits personal details, TLS prevents anyone intercepting that information in transit.

4. It's expected. Any professional business website in 2026 should have HTTPS. Not having it signals to visitors that the site isn't maintained — even if your business is excellent.

What does this mean for your website?

The good news is that TLS certificates are now free and automatically issued by most modern hosting platforms. At Sysvyn, every site we deploy comes with a TLS certificate installed and auto-renewing — you never have to think about it.

If your existing website doesn't have the padlock, the fix is usually straightforward: either your hosting provider needs to issue a certificate, or you need to move to a host that includes it by default.

Not sure if your site is secure? Open it in a browser and look at the address bar. If you see a padlock, you're good. If you see "Not secure" or just http:// instead of https://, it's time to fix it.

Key takeaways

  • TLS is the technology behind the padlock in your browser
  • It encrypts data between your browser and a website's server
  • SSL and TLS mean the same thing in practice — TLS is just the newer version
  • HTTPS = HTTP + TLS. No TLS = no HTTPS = no padlock
  • Google ranks secure sites higher and flags unsecured ones as "Not secure"
  • All Sysvyn-hosted sites include TLS automatically — it's never an extra cost

What's next?

Now that you understand TLS, a natural next question is: how does the internet know where to send your data in the first place? That's DNS — and it's the topic of our next article.

Or if you're wondering about the difference between HTTP and HTTPS in more depth, we cover that too. Check the related articles in the sidebar.