The lock is not the whole of trust

The lock says the path is closed. It does not say the page is the right business.

The customer also looks at whether the name on the sign and the name on the page are the same. The lock alone does not make a fake page honest.

What it is for SSL is the lock in the browser. The address opens with https. On a page without the lock the visitor sees a warning and leaves the form.

How it sits The certificate closes the path between you and the visitor. It does not store the card number with you. The payment page is separate.

Where it breaks The lock is not the whole of trust. A certificate has an end date too. When it ends, the lock drops and the page warns. Renewal sits inside the hosting account.

What to do A certificate binds to the domain it was written for. Payment ends on the Stripe page. The card number does not sit on this site.