> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.squarecloud.app/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Site without padlock (HTTPS/SSL)? How to fix

## Why the padlock matters

When a visitor opens your site and sees "Not secure" in the browser bar (or the padlock is missing), trust drops. On top of that, HTTPS is a ranking factor on Google and a requirement for many modern web features. Having the padlock isn't a luxury — it's the bare minimum today.

## What SSL/TLS and HTTPS are

* **SSL/TLS** is the technology that **encrypts** the connection between the browser and the server.
* **HTTPS** is HTTP running over that secure connection.
* The **SSL certificate** is the "document" that proves your site's identity and enables the padlock.

## Common causes of "Not secure"

* **Certificate not issued yet**: right after setting up the domain, SSL can take a few minutes to be provisioned.
* **DNS not propagated**: if the domain doesn't point correctly yet, the certificate isn't issued.
* **Mixed content**: the page loads over HTTPS but pulls images or scripts over HTTP — and the browser shows the warning.
* **Access over HTTP**: the visitor typed `http://` instead of `https://`.

## How to fix it

**1. Make sure the domain is pointed and propagated.** SSL is only issued after DNS points correctly. See [How to point your Registro.br domain to your application](https://help.squarecloud.app/en-us/article/how-to-point-your-registrobr-domain-to-your-application-1qrcjvz/).

**2. Wait for the certificate to be provisioned.** On Square Cloud, SSL is provisioned automatically as soon as the domain is set up — usually within a few minutes.

**3. Fix mixed content.** Switch internal links from `http://` to `https://` (or use relative paths). Use the browser console (F12) to find what's still loaded over HTTP.

**4. Force HTTPS.** Redirect all HTTP traffic to HTTPS. With Cloudflare active, just enable "Always Use HTTPS" in the panel.

## On Square Cloud, SSL is automatic

You don't need to buy or install a certificate manually: as soon as your domain is set up, Square Cloud takes care of SSL for you. Combined with the premium Cloudflare included in the plans, your site gets the padlock and a secure connection with no extra work.

## Still no padlock?

If a few hours have passed and the site still shows "Not secure", the most common reason is DNS propagation — check [Why hasn't my domain propagated yet?](https://help.squarecloud.app/en-us/article/why-hasnt-my-domain-propagated-yet-f5jzoy/).