Neither applied consistently
Data moves and sits in plain, readable form. Common on older or unmaintained sites where the setup predates HTTPS becoming standard.
SECURITY · ENCRYPTION
Data unreadable without the key, everywhere it sits
Encryption scrambles data so it is unreadable to anyone without the key. In transit means that applies while data moves across a network. At rest means the same applies while it sits on a disk, including backups.
Applying only one is a common gap. HTTPS protects the connection, but says nothing about what happens to that data once it lands on a server or a backup drive.
THE RANGE OF PRACTICE
What partial encryption looks like, and what consistent encryption looks like
Described by behaviour, not by a score.
In transit only
HTTPS is switched on for the connection, but backups and stored data sit unencrypted on a shared drive or default server configuration.
Both, applied consistently
Data is unreadable without the key at every point: moving across the network and sitting on disk, including backups.
WHERE WE SIT
Both, by default, on everything we build
One of three measures that cost nothing extra because they are how we build anyway.
Encryption in transit and at rest is applied by default on every system we build, regardless of budget. It is not an upgrade a client specifies or pays more for. A lost or stolen backup drive, or an intercepted connection, reveals nothing readable without the key.
STRAIGHT ANSWERS
Questions about encryption
The ones that come up before anyone signs anything.
In transit means data is scrambled while it moves across a network, between a browser and a server, so intercepting the connection reveals nothing readable. At rest means the same applies to data sitting on a disk, so a stolen or improperly accessed drive is still unreadable without the key.
HTTPS covers encryption in transit, which stops the connection itself being read. It says nothing about what happens to that data once it lands on a server or a backup drive, which is why encryption at rest is a separate, equally necessary measure.
With encryption at rest applied consistently, a lost or stolen drive is unreadable without the key, which is not stored alongside the data. Without it, whoever has the drive has the data in plain, readable form.
By default, on every system we build, regardless of budget. It is one of the three measures that cost nothing extra to include because they are how we build anyway, not an upgrade a client has to specify or pay more for.
Send us your website address. We will tell you what is exposed.
The free technical audit covers security headers, plugin and theme inventory, known vulnerabilities and whether your admin login is publicly reachable. Two days, no charge, no obligation.