Even if a website has the https:// as well as a padlock, the certificate could however be expired — meaning your connection wouldn't be protected. Without having an SSL certificate, just the letters HTTP – i.e., without the S for Safe – will show up. A padlock icon may even https://www.hostscheap.com/ssl-certificates