The short answer: the padlock means the connection is encrypted — free to get, and absence is disqualifying — but it says nothing about who’s behind the site. Small sites get hacked by bots, not rivals, hunting outdated software and weak passwords. Six habits prevent almost all of it: SSL everywhere, updates applied, strong unique passwords, 2FA on the accounts that matter, real backups, and knowing who has access.
What the padlock actually tells you
When a browser shows the padlock (and the address starts with https), traffic between visitor and site is encrypted — passwords, form fills and card details can’t be read in transit. That’s it. It doesn’t vouch for the business, the content or the intentions behind the page; certificates are free via Let’s Encrypt, so scammers have padlocks too.
Two practical consequences:
- No padlock is disqualifying. Browsers stamp “Not secure” on the address bar, customers notice, and there’s no excuse — it’s free and takes minutes for any competent host to fix. Anyone charging you for a basic SSL certificate is selling bottled tap water.
- A padlock isn’t a trust badge. Real trust signals live elsewhere: a domain you own, consistent details, genuine reviews. Teach your customers-brain the difference too — it’ll serve you when you’re the one shopping.
Who actually hacks small NZ websites
Nobody sits in a hoodie targeting your plumbing site. The threat is automation: bots sweep the entire internet around the clock, probing every site they find for known holes — outdated plugins, default logins, passwords reused from breached lists. When one gets in, your site becomes free real estate: spam links injected into pages, malware served to visitors, phishing pages hosted quietly in a corner.
You feel it as consequences: browsers warning visitors away, Google flagging the site, emails bouncing because your domain got blacklisted — and a cleanup job that costs more than years of doing it right. CERT NZ’s business guidance says the same thing security people always say, because it’s true: almost all of this is preventable with basics.
The six unglamorous habits
- SSL on, everywhere, renewed automatically. Covered above. If your provider handles it, this is a checkbox, not a task.
- Software kept current. The classic small-site hack is an outdated plugin with a published hole. If your site runs on WordPress or similar, updates are a weekly discipline — or the reason to pay someone for whom they are. If nobody has updated your site’s machinery since it launched, that’s the finding.
- Strong, unique passwords. One password per account, long, stored in a password manager instead of a spreadsheet called
passwords.xlsx. Bots try breached-password lists first; reuse is how they win. - 2FA on the accounts that own everything. Email first — it resets all the others — then domain registrar (the crown jewels: whoever controls that account controls your address), then hosting and Google. Ten minutes each.
- Backups that restore. Automatic, stored separately from the site, and tested — an unrestored backup is a hope, not a plan.
- Access hygiene. Know who has logins — past developers, former staff, that agency from 2022 — and remove anyone who no longer needs them. Offboarding is security too.
What “we handle security” should mean
When a provider says security is included, that phrase should decompose into the list above: certificates issued and renewed, platform kept current, infrastructure patched, backups taken and restorable, and no work left on your plate. That’s what “hosting, SSL and security, all handled” means on LaunchPad sites — the stack is modern static hosting with no plugin surface to rot, which quietly removes habit #2, the one that catches most small sites.
What stays yours on any plan, anywhere: your email account, your registrar login, your passwords, your 2FA. Twenty minutes of setup this week — and you’re ahead of most of the businesses on your street. Then the machines scanning for the weak ones move along to someone else.