- Normal site:
The connection to the site is not encrypted, and anything you post to or get from the website is transferred normally. This is the normal state for most web pages you will visit, and is normal for regular browsing.
- Secure site:
The connection to the site is encrypted, and anything you post to or get from the website is securely transferred to prevent eavesdropping. This is a common state for on-line shopping, most e-mail providers who supply webmail, and a number systems for securely logging in, etc.
Unlike Firefox, Pale Moon will display the verified domain name for these types of connections.
- Secure site with extended validation:
The connection is encrypted like in (2), but the certificate owner has also been verified through an extended validation process. This is a common state for higher-security sites like on-line banking, eMoney providers, and secure governmental sites dealing with highly personal information. Pale moon will display the verified organization name. Because these kinds of certificates are much more expensive, most smaller businesses will not use extended validation for their encrypted pages and you will see a "domain verified" encrypted connection instead (as in (2)).
- Low-grade encrypted, or mixed-content site:
Although the protocol used is https, the connection is not trusted. This can be caused by a particularly low-grade encryption used (which takes very little effort or time to circumvent) or by mixed secure and non-secure content on a single page. The latter can be a common occurrence if you have pages restored after a browser shutdown (e.g. through session restore or if you use "show my windows and tabs from last time"). Pale Moon will, in this case, also not display the domain name or validated organization name, and will not show a blue or green border or identity panel background.
Be very careful when you see this icon!
Do not enter any login, financial or personal information when you see this icon displayed. If it was a cached page, completely refresh the page (Ctrl+F5) and check for proper encryption.
At all times, you can click the displayed website icon or domain name/organization name for basic details about the encrypted state, or you can click the padlock itself to open a more detailed window with information about your connection.