HTTPS is the encrypted version of the protocol your browser uses to reach a site; the SSL/TLS certificate confirms the site's identity and protects transmitted data (passwords, forms, payments) from eavesdropping.
The padlock by the address means data between you and the site is encrypted – nobody along the way (e.g. on open Wi-Fi) can read your password or card number. HTTPS is the absolute standard today: browsers mark sites without it as "not secure" and Google treats encryption as a ranking signal.
Certificates can be free (Let's Encrypt) and auto-renewing – a missing HTTPS in 2026 signals nothing but neglect.
Practical note: HTTPS alone does not make a site "secure" in the broader sense – it protects transmission but doesn't patch holes in an outdated CMS. Security is a practice, not a padlock.