What the padlock proves
The padlock means the connection is encrypted — not that the business is trustworthy. It stops eavesdropping between the visitor and your site.
No. It only proves the connection is encrypted, not that the owner is honest. A scam site can still show a padlock.
Mixed content breaks it
If a secure page loads an image or script over insecure http, browsers flag mixed content and may hide the padlock. Everything on the page should load over https.
Key takeaway
One http asset can strip the padlock from an otherwise secure page — load everything over https.