How to check whether your business uses secure connections

This guide was written to help business owners and IT staff who want to make sure their companies’ sites and systems are protected, with an SSL certificate properly set up.

Before you start:

Run every test in an incognito tab (Ctrl+Shift+N in Google Chrome, Ctrl+Shift+P in Firefox). Otherwise, your browser may stop showing security warnings you’ve already accepted in the past, leading to a wrong diagnosis.

You may get different results in different browsers, so run the tests in all the main browsers to make sure the connection is secure whichever browser the user is on.

1. List every site and system the company uses

For a complete diagnosis, put together a list of all the browser-based systems your company’s employees and customers use. Some examples are the company website, webmail, ERP, accounting and HR systems. Don’t forget that in many cases employees need to access other companies’ web systems. Run the tests on those systems too.

This check can be done at different depths, depending on the risk matrix of your company’s operations and the nature of the data the organization handles.

2. Make sure the systems use https

HTTPS is the secure communication protocol that succeeded HTTP. The extra “s” literally stands for secure. Try opening the link to each system with https in the address. Ideally, the page loads without errors, and the padlock shown before the link has no warnings.

For more complete details, click the padlock icon and see whether the browser shows the message “Connection is secure” (closed padlock).

2.1. Assess the issues

Several things can go wrong when you aren’t browsing over a 100% secure connection:

The site doesn’t load with https: This happens when your computer can’t establish a secure connection with the application’s server over secure protocols. The SSL certificate may be missing or set up incorrectly.

“Your connection is not private” warning: This happens when your browser can’t verify that the site or application is safe to browse and that all communication with it is encrypted, which poses major security risks.

Red padlock or “Not secure” message: This means the SSL certificate is missing or set up incorrectly and the connection is insecure. When this happens, browsers show a warning like this one:

Mixed content warning: This happens when the server, despite having an SSL certificate, isn’t using it for every resource on the site, so the connection is partly insecure and shows a warning icon (a padlock with an alert sign).

Notes: Each browser shows its warnings differently. Some of the main ones are:

Google Chrome:

Mozilla Firefox:

Microsoft Edge:

Internet Explorer:

3. Try forcing the sites to load insecurely over http

Even if the security certificate is present and the connection is secure, you can force an insecure connection by removing the “s” from the protocol and trying to load the site over plain HTTP. The site should redirect the connection to https automatically. If it doesn’t, your connection isn’t 100% protected, since it lets users skip the secure HTTPS protocol.

4. How do I fix the security errors I found?

The SSL certificate must be issued and properly applied to each site, system and application. There are different types of SSL certificate suited to different situations and applications. With Raszio website hosting, the SSL certificate is already included, set up and renewed automatically.

For other companies’ systems, let whoever is responsible for the system or company know, so they can take the necessary steps. This awareness is essential to make the web safer for all of us. Communication is always a two-way street.