By the end of this lesson you will be able to
- Explain what the padlock and https:// do and do not tell you about a website.
- Pick out the real domain in a web address by reading it from right to left.
- Recognise a look-alike address and a fake download button in a simulated example.
- Respond sensibly to a browser warning page instead of clicking past it.
- Follow a safe routine when you are unsure about a site.
Anyone can build a website that looks like a bank, a shop or a government office. The skill that protects you is not memorising bad sites, because new ones appear every day. It is knowing what to check, and knowing which checks prove very little. In this lesson you will learn what the padlock really means, how to read an address properly and what to do when your browser shows a warning. All the scam examples here are educational simulations with fictional names; none of them are real sites.
What the padlock does and does not mean
HTTPS is the secure form of the web's request-and-reply language. When a site uses it, the browser and the web server set up a private connection using TLS, so that anyone listening on the way, such as someone on the same public wifi, sees scrambled data (encryption). The browser also checks the site's certificate, a kind of identity card that says the site really owns the domain name in the address bar. The browser shows this as a padlock or a similar icon beside the address.
Here is the important limit. The padlock means that the connection to that domain is private. It does not mean that the owner of the domain is honest. A criminal can buy a domain such as safarisavlngs.example, get a certificate for it, and show a padlock. Free certificates are easy to get, so many scam sites now use HTTPS. Think of a sealed, tamper-proof envelope: it tells you nobody read the letter on the way, but it says nothing about who wrote it.
- The connection to this domain is encrypted
- People on the same network cannot read or change the data
- The certificate matches the domain in the address bar
Useful, but limited
- That the owner is honest
- That this is the domain you meant to visit
- That the page has no scams or fake offers
- That files you download are safe
Never treat it as proof of trust
Read this figure as text
Two columns comparing what the browser padlock proves about a website and what it does not prove.
Two columns. The left column, titled The padlock does tell you, lists three points: the connection between your browser and this domain is encrypted; other people on the network cannot read or change the data in transit; the certificate matches the domain in the address bar. Its verdict is useful but limited. The right column, titled The padlock does not tell you, lists four points: that the owner is honest; that the domain is the one you meant to visit; that the page is free of scams or fake offers; that the files you download are safe. Its verdict is never treat the padlock as proof of trust.
Reading an address from right to left
The most reliable check is the address itself. A web address has several parts, and only one of them, the domain name, tells you who controls the site. The domain ends at the first single slash /. Look at the part just before that slash and read backwards from the right: the last two or three pieces, such as example.org, are the domain. Anything to the left of that, separated by dots, is a subdomain, which the owner of the domain can create freely. Scammers use long subdomains to make the front of the address look familiar.
https://ProtocolOnly says the connection is encryptedsafarisavings.example.SubdomainInvented by the owner to look familiaraccount-verify.SubdomainAnother invented labelexample.netReal domainWho controls the site: read from the right/loginPathA page on that siteRead this figure as text
An address broken into labelled parts showing the real domain hidden after a familiar-looking subdomain.
An educational simulation of a suspicious address: https://safarisavings.example.account-verify.example.net/login. It is split into five parts. https:// is the protocol, which only means the connection is encrypted. safarisavings.example. is a subdomain, which is just a label the owner can invent and is the part that tries to look familiar. account-verify. is another subdomain. example.net is the real domain, the part you read from the right, and it belongs to whoever owns example.net, not to Safari Savings. /login is the path on that site. The lesson is that the real owner is the domain just before the first single slash, here example.net.
Other tricks use a domain that is close to the real one. These are called look-alike addresses. Common changes are a swapped or doubled letter (safarisavlngs with a lower-case L in place of an i), a number in place of a letter (safar1savings), an extra word (safarisavings-secure), or a different ending (.net in place of .org). Read slowly, letter by letter, because your eyes tend to fill in what you expect.
| Address | Real owner of the domain | Verdict |
|---|---|---|
| https://www.safarisavings.example/login | safarisavings.example | The address you expect |
| https://www.safarisavlngs.example/login | safarisavlngs.example | Look-alike: L in place of i |
| https://safarisavings.example.account-verify.example.net/login | example.net | Long subdomain hides the real domain |
| https://www.safarisavings-secure.example/login | safarisavings-secure.example | A different domain with an extra word |
Fake download buttons and pop-ups
Some sites earn money from adverts that are made to look like part of the page. On a site offering free software, a big green Download button may be an advert for something else, while the real link is small and plain. Clicking the wrong one may install unwanted programs. Pop-ups that say your computer has a virus, or that you must update something now, are the same kind of trick: they borrow your fear to make you click. Real browsers and operating systems do not tell you about viruses through a web page.
Download Free Document Viewer
Version 4.2 | Size 18 MB
Educational simulation: not a real site.
- Marker 1: Advert disguised as the download button
- Marker 2: Plain link to the real file
- Marker 3: Is this the publisher's own domain?
Read this figure as text
A simulated browser window showing a free software page with a large advert button and a small real download link.
Educational simulation of a browser window at https://www.example.org/freeviewer with the title Free Document Viewer. The page body reads: Download Free Document Viewer, Version 4.2, Size 18 MB. Two buttons appear. The first, a large primary button labelled DOWNLOAD NOW - FAST, is marker 1 and is an advert that leads to another site. The second, a plain button labelled Download from the official site, is marker 2. Marker 3 points to the address bar and tells you to check that the address is the publisher's own domain before you download. The warning is: do not click the biggest or brightest button; look for the plain link on the publisher's own site.
- Download programs only from the publisher's own site, or from the official app store of your system (App Center on Ubuntu, Microsoft Store on Windows).
- Before you run a download, look at its name and type. A file called
viewer-setup.exethat you did not expect on Ubuntu, or a.zipthat wants to open a program, is a warning sign. - Close pop-ups using the browser's own tab or window close button, not the button inside the pop-up.
- Ignore "you have won" banners, countdown timers and fake system alerts.
Browser warning pages: stop and read
Browsers check addresses against lists of known dangerous sites and test the certificate when they connect. If something is wrong, they replace the page with a full-screen warning. Firefox shows a title such as Warning: Potential Security Risk Ahead. Chrome and Edge show Your connection is not private for certificate problems and Deceptive site ahead or Dangerous site for known scams. The wording changes between versions, but the colour is usually red and the message is clear.
Warning: this site may be dangerous
The certificate does not match the site name, or the site has been reported as deceptive.
Attackers might try to steal passwords or card numbers.
Educational simulation.
- Marker 1: The safe choice
- Marker 2: Shows a Continue anyway link: do not use
- Marker 3: Check the address
Read this figure as text
A simulated browser warning page with a heading, an explanation and two buttons, one to go back to safety.
Educational simulation of a browser warning page at https://www.example.net/login. The body reads: Warning: this site may be dangerous. The site www.example.net has a certificate that does not match its name, or has been reported as deceptive. Attackers might try to steal information such as passwords or card numbers. Two buttons: Go back to safety, marker 1, the primary and correct choice; and Advanced, marker 2, which reveals an option to continue anyway, not recommended. Marker 3 points to the address bar, where you can confirm that the address is not one you meant to visit.
A routine for when you are unsure
- Did you arrive from a message or advert you did not ask for?
- YesDo thisClose it. Open the site from your own bookmark instead.
- NoIs the real domain, read from the right, the one you expect?
- YesIs the browser showing a warning page?
- YesDo thisClick Go back to safety.
- NoDoes it ask for passwords, card details or urgent action?
- YesDo thisConfirm by another route, such as the phone number printed on your card.
- NoDo thisCarry on with normal care. Never enter a password on a page you doubt.
- NoDo thisWrong domain. Close the tab and do not enter anything.
- YesIs the browser showing a warning page?
Read this figure as text
A yes or no decision tree that ends in either carrying on with care or leaving the site.
A yes or no decision tree. Start: did you arrive by a link in a message or advert you did not ask for? If yes, leave and open the site from your own bookmark. If no, ask: is the real domain, read from the right, exactly the one you expect? If no, leave the site. If yes, ask: is the browser showing a warning page? If yes, go back to safety. If no, ask: is the site asking for passwords, card numbers or an urgent action? If yes, check by another route, such as calling the number on your card. If no, carry on with normal care.
If you have already typed a password into a page you now doubt, change that password on the real site straight away (typing the address yourself) and read the lesson on spam, phishing and account security. If you entered card details, tell your bank. You will not be in trouble for asking; banks deal with this every day.
Common mistakes
✖ Instead of: Trusting a site because it has a padlock.
✔ Do this: The padlock shows that the connection is encrypted. Check the domain and what the page asks for.
✖ Instead of: Reading an address from the left and trusting the first familiar name.
✔ Do this: Read from the right, before the first single slash, to find the real domain.
✖ Instead of: Clicking Advanced and then Continue anyway to see the page.
✔ Do this: Click Go back to safety. If you need the site, reach it from your own bookmark.
✖ Instead of: Clicking the biggest download button on a free-software page.
✔ Do this: Look for the plain link on the publisher's own site, or use the official app store.
If something goes wrong
- A site I use all the time suddenly shows a red warning page.
- Do not continue. Check the address for a typing error. Then check your computer's date and time and try on another network, such as mobile data. If it persists, contact the site's owner by a number or address you already trust.
- I clicked a fake download button and something installed.
- Do not run it again. Close the browser, open Settings and look in the list of installed programs (Settings, Apps on Windows; App Center on Ubuntu) and remove anything you did not choose. Then follow the incident response lesson and change important passwords from a clean device.
- A pop-up will not close and says I have a virus.
- Close the browser tab or window using the browser's own X button or press Alt+F4. If the browser restarts the page, choose not to restore the tabs. Do not call numbers or install anything it suggests.
- I cannot tell which part of an address is the domain.
- Find the first single slash after https://. The text before it is the host name; the last two or three dot-separated pieces are the domain. Paste the address into a text note and underline from the right.
Key terms
- HTTPS
- The secure version of HTTP, which encrypts what passes between you and a website.
- TLS (Transport Layer Security)
- The technology that scrambles data between your device and a website so others cannot read it.
- digital certificate
- A digital certificate is an electronic identity card that shows a website controls its domain name.
- look-alike domain
- A look-alike domain is an address made to resemble a real one, using a swapped letter, an extra word or a long subdomain.
- Domain name
- The readable name of a website, such as example.com.
- Phishing
- A trick message that pretends to be from a trusted source to make you give away passwords or money.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Find the real domain in five addresses
On paper or in a note, write down each of these fictional addresses and underline the real domain by reading from the right before the first single slash: (1) https://www.kamaupost.example/track, (2) https://kamaupost.example.parcel-fix.example.org/track, (3) https://www.kamaupost-delivery.example/track, (4) https://www.kamaupostt.example/track, (5) https://tracking.kamaupost.example/parcel. Mark which one you would trust if you expected the genuine address to be www.kamaupost.example, and say why. Then open your own browser, visit example.com, and click the padlock or site information icon to see what it tells you about the connection.
Challenge: write a rule card for a relative
Imagine a relative who often clicks links in messages. Write a card of no more than six short rules telling them how to check a site, what a padlock means, and what to do on a warning page. Test your card on a friend by showing them two of the fictional addresses from the practical above.
Knowledge check
7 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- The padlock means the connection to that domain is encrypted. It does not mean the site is honest.
- Read the address from the right, before the first single slash, to find the real domain.
- Look-alike addresses use swapped letters, extra words, different endings and long subdomains.
- Do not follow links in messages for logins. Use your own bookmark.
- On a warning page, choose Go back to safety. Download programs only from the publisher or an official store.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Firefox Support: connection security (Mozilla)
- Microsoft Edge help and learning (Microsoft)
- Google Chrome Help (Google)
- What is HTTPS? (MDN Web Docs)