HTTPS protects data in transit between a browser and the server it connects to. A valid TLS certificate supports that connection and server authentication. It does not prove that a business is trustworthy, that an application has no vulnerabilities or that a website complies with privacy law.

Check the whole public journey

Verify that HTTP requests move to the correct HTTPS URL, certificates cover the active hostnames and pages do not load insecure scripts or images. Include forms, downloads and external integrations in the check. Certificate renewal needs an owner and a failure alert even when a hosting platform normally automates it.

Use current platform guidance for TLS and security headers. A policy copied from another application can break embeds, media or integrations; test it against the actual site before enforcing it.

Protect what HTTPS does not

  • Keep framework, plugin and dependency updates under review.
  • Validate submitted data on the server, not only in browser fields.
  • Enforce authorization on protected actions and records.
  • Store credentials in an appropriate secret store rather than the repository or client bundle.
  • Limit account access and remove access that is no longer needed.
  • Keep backups and verify a restoration procedure.

For a contact form, the important questions include who receives the message, whether failures are monitored and whether personal details leak into logs. A valid certificate cannot repair an unconfigured email provider or an exposed API error.

Minimise information collection

A general enquiry form should not request passwords, identity documents or sensitive records. Explain what the information is used for and provide a privacy contact. Requirements depend on the business and processing involved; obtain qualified advice for legal obligations rather than treating HTTPS as a compliance certificate.

Our website care service covers operational checks and maintenance scope. If a site includes user accounts or sensitive workflows, discuss the security requirements explicitly during application discovery. Security is continuing work, not a padlock graphic added at launch.