That little padlock next to your web address means the connection between your visitor and your website is encrypted. Nobody sitting on the same coffee-shop wifi can read what your customer types into your contact form.
You already have it Every site we build is served over HTTPS, the certificate is included, and it renews itself automatically. You don't buy it, install it, or remember to renew it. If you've been quoted for an "SSL certificate" by someone else, you don't need it.
What if I see "Not secure"? Two usual causes:
- You're looking at the http:// version of an address out of an old bookmark or an old printed card. Typing the plain address normally lands you on the secure one.
- The domain was pointed somewhere else, or partly pointed. Send us a ticket and we'll look.
Either way, tell us. Don't leave it — visitors do notice that warning and it costs you calls.
What this does and doesn't cover It protects information in transit, which is the thing that matters for a contact form.
It is not a promise that nothing can ever go wrong anywhere — no honest person can tell you that about any website. What we can tell you is what we actually do: your site is hosted on infrastructure that patches itself, you have no plugins sitting there going out of date, and there is no separate login on your website for an attacker to guess.
That last one is worth saying plainly. A lot of small-business sites get broken into through an out-of-date plugin or a weak admin password on the site itself. Yours doesn't have either.