What the padlock is
The padlock in the browser's address bar means the connection between the visitor and your website is encrypted, and that a certificate confirms the site is the one it claims to be. Without it, browsers show "Not secure" in the address bar, and on some pages a full warning screen before the visitor can continue.
That is all it means. It does not mean the site is well built, free of malware, or trustworthy in any broader sense. But its absence means something specific to visitors: this business has not done the basic thing, and I should not type my card number here.
For a booking-led business that takes deposits, a missing padlock is a closed door.
Why it disappears
The certificate expired. Certificates last a fixed period, often ninety days for the free kind, and must be renewed. If renewal was manual and nobody did it, or automatic and something broke, the certificate lapses and the warning appears overnight.
The hosting changed. A site moved to a new host, or a new server at the same host, and the certificate did not move with it. The new server has no certificate, or a default one for the wrong domain.
The domain changed. A new domain, or a switch between www and non-www, without a certificate that covers both. Visitors to one version get the warning.
Mixed content. The certificate is fine, but the page loads an image or script over an unencrypted address, so the browser downgrades the padlock. Common after migrating an old site: the pages are secure, the images inside them still point at the old http:// addresses.
A CDN or proxy in the middle. Cloudflare or a similar service sits in front of the site with its own certificate, and the connection between it and the host is not encrypted or is misconfigured. The visitor sees a padlock sometimes and an error other times.
How to check which one you have
Click the padlock, or the "Not secure" label, in the browser. It tells you whether there is a certificate, who issued it, when it expires, and which domain it covers. An expired date or a mismatched domain is the answer immediately.
If the padlock is there but a page shows "Not fully secure", it is mixed content. The browser's developer console lists the insecure addresses.
If it works on yoursite.com but not www.yoursite.com, or the reverse, the certificate does not cover both.
The fix
Get a certificate that renews itself. Every reputable host now offers free certificates from Let's Encrypt or similar, renewed automatically. If yours does not, turn it on in the hosting panel; if the host does not offer it, that is a reason to consider the host. A certificate you have to remember to renew will be forgotten again.
Cover both versions of the domain. The certificate should include yoursite.com and www.yoursite.com, and the site should redirect one to the other so there is one address.
Force encrypted connections. The site should redirect every http:// request to https://, so nobody lands on the unencrypted version by following an old link.
Fix mixed content. Search the database and theme for http://yoursite.com and replace with https://. There are tools that do this safely in one pass. Then check the console again.
If a CDN is involved, set its encryption mode to full, with a valid certificate on the host as well, so both halves of the connection are encrypted.
Done properly this is an hour or two of work, and then it never needs thinking about again.
What it does not fix
A padlock restored does not remove malware, update abandoned plugins, or fix a dead contact form. It is one item on a longer list, and it is on the list because its absence is so visible to customers. If the padlock lapsed, it usually lapsed because nobody was watching the site, and the other things nobody was watching are worth checking at the same time.
Keeping it
Automatic renewal handles the certificate. Monthly uptime monitoring that checks the certificate, not just the page, catches a renewal that silently failed before a customer does. Both are standard on a care plan, and the padlock is one of the things we check first in any diagnosis, because it is quick to fix and expensive to leave.