The Green Address Bar Is Gone. The Confusion Isn't

The green address bar is gone, but the confusion it left behind isn’t.

Remember when a green bar and a padlock meant a site was trustworthy? Browsers ditched the green bar years ago, but the habit of equating encryption with endorsement stuck around.

A padlock only tells you the connection is encrypted. It doesn’t vet the site on the other end. A phishing page can—and often does—have a valid certificate.

Someone forwards a suspicious login link with a reassuring, “But it has a padlock.” Or an employee lands on a polished fake page and thinks, “This looks legit—see the lock?”

Encryption isn’t endorsement. TLS protects data in transit; it doesn’t prove the site is who it claims to be. A convincing page and a padlock can still lead to a breach.

So what should you teach your team instead?

• Read the actual domain before you enter a password. Not just the brand name buried in a long URL.
• Watch for extra words, swapped letters, and unexpected endings. A subtle typo or a .co instead of .com can fool even sharp eyes.
• If an email creates urgency, open the service through your usual bookmark or app instead. Don’t click the link.
• Use your password manager as a clue. If it doesn’t offer the expected login, pause and check why.

The most important part of a login page isn’t the lock icon—it’s the domain beside it. Teach your team to ask, “Where am I?” instead of “Is there a lock?”