This translation has not been editorially reviewed yet. The German version is authoritative. Deutsche Fassung

Data protection

Why does every website need HTTPS?

Because without HTTPS, everything that flows between a visitor and a website can be read along the way — including names, addresses, and messages from a contact form. HTTPS encrypts this transmission completely. Our check establishes whether your website is consistently delivered over HTTPS, and treats unencrypted delivery as a serious finding.

What HTTPS specifically protects

Many stops lie between a visitor's browser and your server: the café Wi-Fi, the network operator, intermediate nodes on the internet. Without encryption, any of these stops can read what's being transmitted. For simply reading a page, that concerns the content being viewed — it gets genuinely sensitive with forms: a request through your contact form contains a name, an email address, and often a matter that's nobody else's business. HTTPS encrypts the entire connection, so nobody along the way can read it or alter content unnoticed. Where encryption is missing, the audit report points to the duty to take appropriate technical protection measures.

How visitors spot the difference

Browsers make the state visible: on encrypted pages, the address bar shows a padlock icon; on unencrypted ones, common browsers warn with a "Not secure" notice right next to your address. Every visitor sees this warning — before they've read a single line of what you offer. For a business, that's about as bad a first impression as it gets, comparable to a shop with an official warning notice stuck on its door. Switching to HTTPS removes the warning in one stroke; what's needed for that is a certificate your hosting provider sets up.

Consistently encrypted, not partially

The check deliberately asks about consistent delivery over HTTPS. A website that only encrypts the order form and leaves the rest open protects too little: visitors move between pages, and every unencrypted page is an open window. That's why an automatic redirect is standard — anyone who opens the address without encryption lands straight on the encrypted version. After switching over, make sure every embedded file, like images and scripts, also loads over HTTPS, or browsers will flag mixed content.

Open your website and check the address bar: a padlock icon means HTTPS, the "Not secure" warning means an unencrypted connection.
Ask your hosting provider whether a TLS certificate is included in your plan, and have it set up.
Have an automatic redirect set up that sends every unencrypted request to the HTTPS version.
Test several subpages after switching over — images and scripts also have to load over HTTPS.
Make sure the certificate renews automatically, so the website doesn't one day show up with a warning.

Deutsche Fassung dieser Seite

FAQ

How can I tell whether my website uses HTTPS?

Open the website and look at the browser's address bar. If the address starts with "https://" and the browser shows a padlock icon, the connection is encrypted. If the "Not secure" notice appears instead, encryption is missing — and every visitor sees that same warning.

Is HTTPS on the contact page alone enough?

No. The check asks about consistent encryption, since visitors move between pages, and every unencrypted page stays readable along the way. An automatic redirect that immediately sends every unencrypted request to the encrypted version is standard — then there simply is no open variant left.

Without HTTPS, what happens to the entries in my contact form?

They travel across the network in plain text. Every stop along the way — an open Wi-Fi network or an intermediate node, say — can read the name, email address, and message. The audit report therefore treats an unencrypted website as a serious finding and points to the duty to take appropriate technical protection measures when processing data.

Is switching to HTTPS a lot of work?

Usually not. Your hosting provider sets up a TLS certificate, plus a redirect from the unencrypted to the encrypted address. After that, it's worth doing a walkthrough of the website: every embedded file, like images and scripts, also has to load over HTTPS, or browsers will show mixed-content warnings.