Denver Locks Its Front Door Better Than Any City I Checked

“My customer thinks I’ve been hacked.”

That was a Denver client of mine, on the phone, before either of us had said hello properly.

Nobody had hacked her, and nothing on her website had been touched in months.

She fits kitchens, and one of her old customers had gone looking for her gallery, been stopped by a warning from his own phone, and emailed her two lines asking whether she was all right.

Do you know what your website says about you before you’ve said a word to anyone?

The page, before

Picture that gallery page the way it looked that morning.

Her web address ran across the top of the screen. To the left of it, where a small padlock ought to sit, sat the grey words “Not secure”.

Everything underneath that strip was good work, starting with a walnut worktop she’d fitted in the spring, photographed in daylight by someone who understood what they were doing.

Her phone number sat in a font you could read at arm’s length, and three sentences underneath it covered the twelve years she’d been doing this.

The page was fine. The strip above the page was doing all the talking.

Her customer read the strip and never read anything else.

How many people have done exactly that to you in the last month, without ever telling you they were there?

What the lock is, and who puts it there

Without HTTPS, everything a visitor types into your pages crosses the internet as plain readable text, and the padlock is a browser confirming that yours isn’t doing that.

Adding it isn’t your job. It belongs to the company keeping your site online, it costs them a checkbox in an account you’ve probably never logged into, and the longest I’ve watched it take was one bad-tempered afternoon on hosting that should have been retired years ago.

Google doesn’t soften why it matters. Without the lock, intruders can listen in on your visitors and change what they see, photos and scripts and all.

Chrome isn’t quiet about it either. The explanation sitting behind that grey warning reads “the site doesn’t use a private connection. Someone may be able to view and change the information you send and get through this site”.

Read that as the customer rather than as the owner of the business.

Would you type your phone number into that page? Would you let your mother book a plumber through it?

Denver comes out first

I ran the same security check in 24 cities. When I put them in order, best first, Denver was the name sitting at the top.

96.3% of the Denver sites I opened load over a secure connection, where the figure across everything I audited is 94%.

A couple of points isn’t a parade. But every city in this race had already crossed the line somewhere in the nineties, so the gaps get tiny near the top and first is still first.

It’s not a thin sample either. 6,607 Denver businesses went into the count, and 5,103 live websites came out the other side of it.

The page, after

Nothing about my client’s business changed that week.

Same worktop, same phone number, same twelve years.

Her address gained one letter. The grey words vanished. A padlock turned up where the warning had been, small enough that most visitors will never consciously notice it.

One letter, and a page that had been quietly turning people away stopped doing it.

It took twenty minutes of someone’s time, and that someone wasn’t her and it wasn’t me.

When did anything else on your website list ever move that quickly?

Owners find that part hardest to swallow. Her customer had already decided against her, on the strength of a page he never scrolled past the top of.

Trust is the one thing you can lose before anybody’s met you.

The half that gets forgotten

A certificate on its own only does part of the job, and the missing part is the one I find broken most often.

Your old unlocked address is still out there in the world. Someone taps a link from 2019, or reads your name off a business card that went to print before any of this, and lands on the copy without the lock.

It’s nearly always a regular who finds it, and two pool companies ended up showing that warning only to the customers they’d already won.

Your website has to catch that person and carry them across to the locked copy on its own. The instruction that does the carrying is called a redirect, it’s ten minutes of work for whoever built the site, and it’s the sort of thing they’d type while you were still on the phone to them.

90.7% of Denver sites catch that visitor automatically, against 88% nationally.

So most of the city has both pieces working. The rest have a bolt on the front door and a window standing wide open at the back.

Which one is yours? You’ll know in about eight seconds, and I’ll show you the trick at the bottom.

Why Denver got here

Nobody in Colorado woke up on a Tuesday and decided to become the safest city of the 24.

Certificates got cheap, then free, then automatic. Most hosting companies hand you one now without being asked, and plenty of website builders switch it on before you’ve finished arguing about fonts.

A city climbs this particular check mostly by having newer sites sitting on newer hosting, which makes the padlock the one item on my entire list that other people quietly solved while owners were busy running their businesses.

That was my whole theory until wedding photographers, who buy new websites constantly, landed 45 of 47 on the padlock anyway.

That makes the stragglers stand out more, not less.

If your site is still on the naked address in 2026, you weren’t unlucky. You were skipped, probably by a host that had moved on to selling you something else.

Do you know who switched yours on, or when? I’ve asked a lot of owners that, and mostly I get a shrug and the name of a nephew.

What the lock won’t do

I’ve watched owners treat that padlock like a burglar alarm.

It protects the trip between a visitor and your website. It has no opinion about whether your admin password is your dog’s name, or whether the booking plugin you installed in 2021 has had a single update since.

When did that plugin last get one? I ask every new client, and the honest answer is nearly always that they’ve no idea.

I’ve cleaned up sites with a flawless padlock in the address bar and a login page a bored teenager could have walked through.

Locked front door, unlocked back office. Both can be true on the same afternoon, and the padlock will never mention it.

The back office half is passwords, updates and the plugin nobody has opened since 2021, and protecting that half is the longer job.

The customer who trusted the lock anyway

There’s a second version of my client’s story, and Denver comes out of that one worse.

A stranger taps your link. No warning, no grey words, everything about the strip at the top saying this is a real business with its affairs in order.

Then he stands there watching a white screen decide whether it feels like loading your photographs today.

He leaves, and he was further along than the man who got the warning, because he’d already trusted you.

Denver’s phone speed lands on 56 out of 100 where the country manages 58, and speed is the one place this city has nothing to be smug about.

I gave that one a post of its own, because 21st of 24 on phone speed is the habit customers here feel first.

I’d still rather own Denver’s problem than the other one. A slow page loses you a stranger who was curious. A warning loses you the one who’d already decided to spend money.

Go and look at yours

Find something of yours with the web address printed on it. An invoice, the side of the van, a card from before you changed the logo.

Type what’s printed there into your phone, letter for letter, and then watch the strip at the top.

A padlock means your site caught that printed address and carried the person across, so you’re inside that 90.7%. A warning means the print you paid for has been handing customers the grey words, for as long as the print has been out in the world.

I’ve found businesses where the address on the sign out front behaves perfectly and the one on last year’s flyers has been frightening people off since the day it went to the printer.

If the strip did something you didn’t like, put your site through my audit form and I’ll take the rest of my list to it. Takes me a little longer than eight seconds, but not much.

Nobody should have to think about certificates for the rest of their working life. That job belongs to whoever looks after the site, and in Denver it is often me.

Tell me your trade is different

Someone reading this has already decided none of it applies to them.

Nobody finds you cold. Every job arrives through a referral, from a person who has your cell number and would call it before they typed your name into anything.

Is that honestly true of every job you’ve taken this year, or only of the ones you can still remember?

Maybe. I’ve heard it from tradespeople with waiting lists, and once from a surveyor who turned out to be right.

So make the case. Tell me why a warning on your page costs you nothing, and bring the page with you, because I’d like to read the strip at the top for myself.