I used SSL certificate on my site but still it has been hacked.

How do I prevent this from happening?

Do SSL certificate come with a waranty which would compensate me because my site was hacked?

  • 6
    If you can give context over what the hack method was then you could ask specific questions and get good guidance. SSL is not designed to prevent a website being hacked - as both Jeff and Mike said, it just protects communications.
    – Rory Alsop
    Sep 3, 2011 at 9:07
  • 1
    I have a sword, does that mean the bully wouldn't be able to beat me?
    – Lie Ryan
    Sep 3, 2011 at 13:00
  • 10
    Security is full of misconceptions. SSL = security = why am I hacked? If you know don't know what else to consider, it actually is a logical statement. (Be nice to the new guy.)
    – Jeff Ferland
    Sep 3, 2011 at 15:25
  • 1
    You have to consider also, MITM attacks like sslstrip, session hijack, and so on.
    – user4610
    Sep 4, 2011 at 2:20

4 Answers 4


An SSL certificate protects users of your site from having their communications intercepted by a 3rd party. I think it is likely that when you say your site was hacked, this isn't what you're talking about. An SSL certificate does not validate the content of your site, nor does it prevent anyone from accessing it as intended or otherwise. Controls for these are outside the realm of SSL.

There is no warranty regarding SSL certificates other than potential civil liability. Unless your certificate itself was compromised by actions of the issuer, you have no case against them and no warranty is implied.

As far as figuring out what was insecure about your site, how you were compromised, or what needs to be addressed to fix it, you need to have forensic analysis performed on your compromised machine. A review of the website code for the site in question may also be in order.

  • 6
    A minor clarification, SSL protects your communication from being understood, but an adversary could still intercept your communication.
    – this.josh
    Sep 4, 2011 at 18:34
  • Actually, an SSL certificate only certifies users that they're talking to your server, and is used by TLS for key exchange. What version of TLS, encryption algorithm and and a whole lot of other TLS security settings are all dependent on the server. For example, I may have a perfectly valid certificate but still be hacked at the communication level because I still have SSLv3 enabled.
    – BgrWorker
    Mar 2, 2017 at 14:58

SSL certificates don't do anything to prevent your site from being hacked, so you're not going to be able to claim compensation. If properly implemented, they prevent your users' traffic from being intercepted by third parties, which is not the same thing at all.

To stop your site from being hacked again, you need to employ or become an expert in Internet security -- there's no other way. There are so many different ways that your site could be vulnerable that I couldn't even begin to list them all here.

  • Minor clarification, SSL protects your communication from being understood, but an adversary could still intercept your communication.
    – this.josh
    Sep 4, 2011 at 18:36

I've never heard of a warranty on SSL certificates, and even so, it wouldn't be that your site wouldn't be broken into - it'd be a warranty concerning the link between your server and your user's computer.

You may be thinking of those (ridiculous) "verified by XXX" logos you see on websites. Those are intended to give visitors confidence that the site is indeed secure, but again, they don't function as an assertion that nobody can break into your site, as much as an indication that the site is using SSL to protect communications.

There are other logos out there that sometimes show up on websites, sometimes from the same companies that sell certificates, that purport to speak to the security of the site itself, but even so I haven't heard of any of them warranting that claim. Far from it, usually - almost everyone inserts gigantic disclaimers in their license agreements.


Let's say you have SSL, but an outdated OS, poor passwords, your house/work network compromised, not only by you, but by others that also make use of it. How can your server be secure?

There are so many technical paths a malicious guy can try, and social engineering to do. An SSL certificate, can only protected the communication preventing it to be transmitted as plain text and checking if the parts are who they are claiming to be. It's the same say to the user: "Your information will be transmitted by a verified organization locked in a box with one key to lock and another to open. Only you and I have the keys".

But this doesn't mean that no one will be able to exploit that key during the transmission. For example, the attacker can invalidate the HTTPS transmission before the user even note, forcing the information to be transmitted as plain text (e.g sslstrip).

Second, let's say that everything is ok, but you built your page with Wordpress or Joomla for example, with a feel plugins. If you do not have the appropriate guy to check your code, is just a matter of time to someone break in, since exploits for applications and plugins made by those organizations and their users pop out every day on exploits databases.

Just an example, the same can be done on in-house applications, even with automated tools.

SSL is just the tip of the iceberg.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .