What it is
In plain words, before anything else.
HTTPS is the padlock in the address bar. It means the connection between a visitor and your site cannot be read or altered on the way. It has been free for about a decade and is switched on by default nearly everywhere.
It is on this list because it is the floor. Everything else about proving who you are rests on the connection itself being trustworthy first.
What it costs you
The loss you never see happen.
Browsers mark an insecure site as not secure, in front of the customer, before they read a word.
Software is blunter. An agent handling somebody's money will not transact over a connection it cannot verify, and it does not report why.
Check it yourself
Do not take our word for it. Look.
This takes about a minute, costs nothing, and needs no account with us or anybody else. A finding you have confirmed with your own eyes is the only kind worth acting on.
- 1
Type https:// in front of your address and load it.
- 2
A padlock and no warning means you are fine.
- 3
A warning, or a page that will not load at all over https, means it is either off or your certificate has expired. Certificates renew automatically almost everywhere, so an expired one usually means a setting changed.
What we found
Out of 186 businesses we checked ourselves.
- 21 of 186
did not complete a secure connection when we checked. Some of those are certificate faults and some are sites that simply did not answer us in time, which is why we say so rather than grading it as a failure.
Counted from our own checks of 186 real businesses, measured on 2026-09-10, one count per business. No business is named and none of their reports is public. The full write ups are in what we found.
How we fix it
What we do, and what we leave alone.
There is nothing to sell here. It is free everywhere and we point you at the setting.
If your report flags it and the site loads fine for you, that is worth knowing too, and the next check will pick it up.
Next
The checks closest to this one.
- V2
Stopping somebody from quietly pointing your address somewhere else
Every visit starts by asking where your website lives. Without protection, that answer can be forged. - V3
Anyone can send email as you until you stop them
A stranger can send mail from your address today, to your customers, and it will look genuine. - V4
Proving that something really came from your business
An invoice from you and a convincing fake from somebody else look exactly the same to the person holding one.
Is this one open on your site?
The free check runs all sixteen against your own address and tells you which came back clean, in the same plain words as this page.
Free. No signup. Takes about a minute.