How can I tell whether a contest website uses a secure connection?
Look at the address bar. If the address begins with https:// and the browser shows a lock or connection icon, your traffic to that page is encrypted. Click the icon and most browsers confirm the connection is secure and name the site you are talking to. That is the whole message: nobody watching the same network can read what you type. It says nothing about whether the promotion is real. Dishonest operators buy certificates too, so treat encryption as a minimum requirement and then verify the organizer separately, which is what the rest of this page covers.
What the lock actually confirms
A secure connection means the site presented a valid certificate for its domain and your browser negotiated encryption. On public wifi that matters, because it keeps your entry details off the local network. It does not mean the site was vetted by anyone, that prizes exist, or that the data you submit will be handled sensibly. Encryption protects the pipe; it does not vouch for the person at the other end.
Read the domain behind the icon
The domain is the part worth reading. Click the connection icon to see the exact site name, then compare it with the brand you think you are dealing with. Watch for lookalikes: an extra word, a swapped hyphen, a different ending after the brand name, or a domain that belongs to a giveaway site rather than the sponsor. The lock appears on a lookalike domain just as happily as on the real one.
Treat certificates as table stakes
Getting a certificate for any domain is routine and cheap, and many free hosting setups enable HTTPS automatically. So a padlock on a contest page is close to no evidence at all. Sites that used to feel "trustworthy because they were green in the address bar" set a habit worth unlearning: the useful checks start after the lock, with the domain, the sponsor, and the rules.
Notice when the connection is not secure
Browsers flag plain HTTP pages as "Not secure," and some warn more loudly on pages containing forms. Also take certificate warnings seriously: a message that the name does not match, or that the certificate is expired or untrusted, means you cannot confirm who is on the other end. Do not click through those warnings to submit anything, and never enter payment or identity details into an unencrypted form.
Watch what happens across the page
Encrypting the landing page is not the same as encrypting the entry step. Confirm the lock holds when you reach the form, and look at where the form actually submits and what domain owns the page you are typing into. A contest page that loads an entry form from a different domain, or bounces you through a chain of redirects to an unfamiliar address, deserves a pause before you type anything.
Let the questions the page asks guide you
A secure connection does not limit what a page can demand, so judge the requests themselves. Never supply a password, a two-factor code, or an account permission to enter or claim something. Treat a demand for a national ID, bank details, or a Social Security number at entry as a reason to stop, and treat any fee, gift card, wire, or crypto transfer needed to release a prize as a scam signal. Read the privacy note to see who gets your address and email.
Verify the organizer on a channel you chose
Type the sponsor's known address yourself instead of following a link from a post or message. On that site, look for the official rules naming a real company, with a prize, entry period, eligibility, and winner selection spelled out. Compare the promotion you found with what the sponsor publishes. Where a message and the official rules disagree, trust the rules and stop if they cannot be located.
Common mistakes
- Reading the padlock as proof that a promotion is real or that a sponsor approved it.
- Skipping over the domain and trusting a brand logo printed on the page.
- Clicking through a certificate warning "just to look" and then entering data.
- Assuming the entry form inherits the security of the page that linked to it.
- Deciding a request for money or a password is safe because the address bar looked green.
Key takeaways
- HTTPS and the lock mean your connection to the page is encrypted, nothing more.
- Read the actual domain, because lookalike addresses show a lock like any other site.
- Treat certificates as a floor, not a credibility signal; anyone can have one.
- Stop at certificate warnings, plain HTTP forms, and forms owned by unfamiliar domains.
- Judge the requests: no passwords, no security codes, no payment to release a prize, ever.
- Confirm the sponsor and official rules through an address you typed yourself.