Why "we have SSL" is not a security posture
The padlock proves your traffic is encrypted in transit. It says nothing about the twelve other things that decide whether your site gets compromised.
We hear this a lot during scoping calls. Asked about their security posture, someone says: we have SSL.
It is worth taking seriously as a signal, because it usually means the person is engaging with security in good faith and has done the thing that was most visible to them. HTTPS is genuinely important. It is just answering a different question than the one that matters most.
What TLS actually protects
TLS encrypts data between a browser and your server. That prevents someone on the same network reading or modifying the traffic in transit. Before it was universal, this was a real and common attack.
That is the whole of what it does. It is a transport-layer control, and it does its job well.
What it does not touch
An encrypted connection to a vulnerable application delivers the attack payload just as reliably as an unencrypted one. TLS has no opinion about:
- Whether your login form is rate-limited
- Whether your admin panel is reachable from the entire internet
- Whether a user can change an ID in a URL and read someone else's record
- Whether your components have known vulnerabilities
- Whether an upload field accepts a PHP file
- Whether your database credentials are in a file the web server will serve
- Whether you would notice a compromise at all
A more useful set of questions
If you want a quick self-assessment that actually correlates with risk, these are better:
- Could you tell if you were compromised? Most organisations find out from a third party. Logging that nobody reads is not detection.
- When did you last update your components? Not core — plugins, libraries, dependencies. That is where the public exploits live.
- Who has admin access, and do they still need it? Old accounts from departed contractors are a recurring finding.
- Is MFA on the accounts that matter? Hosting, DNS, email, code repository. These are the accounts that turn a small problem into a large one.
- Have you tested a restore? A backup you have never restored is a hypothesis, not a backup.
None of those cost anything to check. All of them tell you more about your actual exposure than the padlock does.