← Years 7–8 Digital Systems

HTTPS and the padlock

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

Part of: 7-8 Digital Technologies Vic Curric - Digital Systems and Security — Module 46, 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 32, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 61, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 63, IGCSE Computer Science 0478 — 5.1 The Internet and the World Wide Web — Module 15, IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 47, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 68, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 90, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 143, WA Computer Science ATAR Year 11 — Cyber Security — Module 96

Understanding HTTPS and the padlock in Years 7–8 Digital Systems

What it does: This address starts with https://, which is what you check for before entering private details on a site. HTTPS has an 's' on the end, which stands for secure. It encrypts data between your browser and the website. HTTPS scrambles data with encryption. Plain HTTP sends data that could be read by someone snooping on the network. The padlock appears in the address bar next to the web address. It is part of your browser, not the web page. Check first. Once you send your details over an insecure connection, they could already have been seen. The padlock only means the data is encrypted in transit. Scammers can also get a padlock for fake sites.

Common mistakes: HTTP does not encrypt data, but line 2 says encrypted is true. The protocol should be HTTPS so the address shows https:// and the data is encrypted. If the site starts with https and shows a padlock, the data between the browser and the site is encrypted. It should say encrypted ← true.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add HTTPS and the padlock to a class →

This module's key terms are also in a printable crossword (Modules 26–74) and word search (Modules 4–74).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which web address uses HTTPS to encrypt data?

https://www.myschool.edu.auhttp://www.myschool.edu.au

Matches

http://mybank.example.com.au/login

↓

The address uses http:// with no S, so the login details would be sent unencrypted. It should start with https://.

Applying

Meanings

Term

HTTPS

Meaning

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

Practice

SET address ← "https://www.school.edu.au"

Testing

Gaps

://www.example.com.au

Check Answer

Spots

1protocol ← HTTP

2encrypted ← true

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which web address uses HTTPS to encrypt data?

A. https://www.myschool.edu.au ✓

B. http://www.myschool.edu.au

HTTPS has an 's' on the end, which stands for secure. It encrypts data between your browser and the website.

2. What does HTTPS do to the data you send to a website?

A. It sends the data as plain text anyone can read

B. It encrypts the data so others cannot read it ✓

HTTPS scrambles data with encryption. Plain HTTP sends data that could be read by someone snooping on the network.

3. Where do you see the padlock that shows a site uses HTTPS?

A. At the bottom of the web page's text

B. In the browser's address bar ✓

The padlock appears in the address bar next to the web address. It is part of your browser, not the web page.

4. You are about to type your password into a login page. When should you check for https:// and the padlock?

A. Before you enter the password ✓

B. After you press the login button

Check first. Once you send your details over an insecure connection, they could already have been seen.

5. A website shows a padlock. What does this prove?

A. Your connection to the site is encrypted ✓

B. The website is definitely trustworthy and safe

The padlock only means the data is encrypted in transit. Scammers can also get a padlock for fake sites.

Match the Pairs

https:// → The start of a web address that shows the connection between your browser and the website is encrypted

http:// → The start of a web address that sends data as plain readable text, with no encryption

Before typing a password or card number, check that the address bar shows a padlock and https:// → https://shop.example.com.au/checkout

A padlock only means the connection is encrypted, not that the site is honest, so a fake site can still have one → https://paypa1-login.example.com

http://mybank.example.com.au/login → The address uses http:// with no S, so the login details would be sent unencrypted. It should start with https://.

I can see a padlock, so this site must be safe to trust. → A padlock only shows the connection is encrypted. It does not prove the site is real or trustworthy, so you still need to check the address and look for scam signs.

Key Term

HTTPS

A secure way for your browser to talk to a website. It encrypts the data you send and receive, and shows https:// and a padlock in the address bar. A padlock does not prove a site is trustworthy.

Fill in the Blanks

1. https://www.example.com.au

Hint: Type the protocol name for the secure, encrypted version of HTTP.

2. https://www.school.example.edu.au

Hint: Type the three characters that separate the protocol from the website name.

3. IF site uses HTTPS THEN browser shows a padlock icon END IF

Hint: Type the icon shown in the address bar when a connection is secure.

4. IF address starts with "http://" THEN warn: data is not encrypted

Hint: Type the word for scrambling data so others cannot read it.

5. padlock shown ≠ trustworthy site

Hint: Type the symbol that means not equal to.

Spot the Error

Question 1

A protocol ← HTTP

B encrypted ← true

C address ← protocol + '://'

D print address

Line A — HTTP does not encrypt data, but line 2 says encrypted is true. The protocol should be HTTPS so the address shows https:// and the data is encrypted.

Question 2

A site ← 'https://bank.com.au'

B if site starts with 'https'

C show padlock

D encrypted ← false

Line D — If the site starts with https and shows a padlock, the data between the browser and the site is encrypted. It should say encrypted ← true.

Question 3

A padlock ← true

B trusted ← always true

C if padlock and unsure

D check the web address

Line B — A padlock only means the connection is encrypted. It does not prove the site is trustworthy, so trusted should be not guaranteed.

Question 4

A action ← enter password

B if action is sensitive

C skip the padlock check

D then type password

Line C — You should check for https:// and the padlock before typing a password or other private details. Skipping the check is unsafe, so the line should be check padlock first.

Question 5

A url ← 'http://shop.com.au'

B if url starts with 'http://'

C data is encrypted

D warn user

Line C — Plain HTTP does not encrypt data, so others could read it. This line should say data is not encrypted.

Student with a class code? Join your class →