You were told to look for the padlock. If it's there, the site is safe, right?

Wrong. That little lock has never meant "trustworthy." It means one thing only: the traffic between you and the site is encrypted. A phishing page can have a perfect padlock. In fact, most do now.

What the padlock actually promises

HTTPS does exactly two things:

  • Encrypts the data moving between your browser and the server, so nobody on the WiFi can read it.
  • Confirms you're talking to the server that owns that certificate — not a fake in the middle.

That's it. It says nothing about who runs the site or whether they plan to rob you.

Why scammers love the lock

Certificates used to cost money and take days. Now they're free and issue in seconds through services like Let's Encrypt. That's great for the open web — and great for criminals.

A fake "your-bank-login" page gets its own free certificate in under a minute. Your browser shows the padlock. You relax. You type your password. The encryption worked perfectly — it just delivered your password safely to a thief.

More than 80% of phishing sites now use HTTPS. The lock is not a filter. It's plumbing.

The check that actually matters

Stop looking at the padlock. Look at the domain name right next to it. That's the part scammers can't fake.

  • Read it right to left. The real domain is the last two chunks before the first slash: login.paypa1.com is paypa1.com, not PayPal.
  • Watch for lookalike letters: rn posing as m, zero as O, paypa1 with a one.
  • Ignore everything before the real domain. paypal.com.secure-login.ru belongs to secure-login.ru.

The padlock is honest. The name is where the lie hides.

Self-host your own safety net

You can block most fake domains before your browser ever loads them.

Run Pi-hole on a Raspberry Pi or old laptop. It sits between your devices and the internet, filtering known malicious and phishing domains from community blocklists. When a bad domain gets requested, Pi-hole drops it — no page, no padlock, no chance to be fooled.

Add a phishing-focused blocklist like the ones from OISD or Phishing Army in Pi-hole's settings. Setup is one flashed SD card and a ten-minute wizard. Point your router's DNS at it and the whole house is covered — including the relatives who click everything.

Bonus: it also kills most ads and trackers as a side effect. Same tool, three problems solved.

The takeaway

Tonight, do one thing: teach yourself to read the domain right to left, ignoring everything before the real name. The padlock protects your connection. Only you can check who's on the other end.