What the lock icon means
Do you see a lock icon next to the address in your browser? That’s HTTPS – an encrypted connection. Everything traveling between a visitor and the website is locked inside an envelope that nobody along the way can read.
- HTTP: mail sends postcards – every mail carrier can read them.
- HTTPS: mail sends locked envelopes – only the sender and receiver have the key.
Without HTTPS, browsers today mark a website as “Not secure” – and visitors run away. Luckily, it’s free today and almost automatic:
Show me: HTTPS on GitHub Pages
- Settings → Pages → check Enforce HTTPS.
- That’s it. The certificate (the website’s electronic ID card) is issued automatically by GitHub, which also renews it by itself.
On other hosting providers, look for “Let’s Encrypt” or “free SSL” – every decent hosting service today offers it with one click.
The boss’s security checklist
HTTPS is the basics, but a project boss watches more than that:
- No secrets in Git –
.envwith your keys is in.gitignore(check withgit status). If a key ever leaks, swap it out immediately. - Strong passwords, never on the website – access to the registrar, hosting, and GitHub is stored in a password manager (your parents’).
- Think before sharing personal data – no exact home addresses, kids’ phone numbers, or names with photos without consent. For photos of classmates or teammates, always ask if you’re allowed to publish them.
- Backups – your code is on GitHub (a backup in itself!), but what about your data? Photos? Keep a copy off the website too.
GDPR for kid bosses: as soon as a website publishes information about other people (team photos, teachers’ names), you need their consent. For classmates under 15, that means parental consent. Your school principal or coach can tell you what your school or club already has in place.
Now it’s your turn 💪
- Turn on Enforce HTTPS and check:
http://your-site...automatically redirects you tohttps://. - Go through the boss’s 4-point checklist and note ✅ or what needs fixing for each one.
- Open your website and look at it through a stranger’s eyes: is there anything there about you or others that shouldn’t be public?
Check: Your website runs on HTTPS with the lock icon, secrets aren’t in Git, and personal data is published thoughtfully and with consent.
What to take away from this lesson
- HTTPS encrypts the connection – today it’s free and mandatory.
- Secret keys and passwords never go into Git or on the website.
- Publishing information about others always requires consent.
© 2026 Ing. Martin Polak / AlgoRhino · Content usage terms