Four acronyms, one job: keeping your visitors' data private. Here is the alphabet, decoded once and for all.
SSL and TLS: the same thing, renamed SSL (Secure Sockets Layer) is the original encryption protocol; TLS is its modern successor. People still say 'SSL certificate' — technically it holds a TLS certificate. Both mean: the padlock, the encryption between browser and server.
HTTPS: the result HTTPS = HTTP + the encryption layer. Everything a visitor sends (passwords, card details) and receives (your pages) travels scrambled. Without it, anyone on the network path can read or alter the traffic — including the 'Not secure' browser shaming.
How the certificate works (the 30-second version) The certificate is your site's ID card, issued by a trusted authority (Let's Encrypt, free). The browser checks it: right domain, valid dates, trusted issuer. Then keys are exchanged and encryption begins — all in the first milliseconds of a visit.
HSTS: the stubborn setting HTTP Strict Transport Security is a header your site sends saying 'ALWAYS talk to me over https — never even try http first.' Good for security: blocks downgrade tricks. The caution: it caches in browsers for months — only enable it once SSL is confirmed stable (the redirect-to-https step comes first).
The practical checklist 1. SSL active (free and automatic on Kairalmas) 2. All http traffic redirects to https 3. No mixed content (old http image links) 4. HSTS once stable
Four acronyms, one checklist, zero excuses — the padlock is free and the trust it signals is priceless.