What the padlock means
It means the connection is encrypted and the certificate matches the domain. It says nothing about whether the site is trustworthy, whether the software is patched, or whether the database is exposed.
Why free certificates are fine
A Let's Encrypt certificate provides identical encryption to a paid one. Paid certificates differ in warranty, organisation validation and support, not in cryptographic strength.
The parts people forget
Redirect HTTP to HTTPS, fix mixed content in themes, and make sure renewal is automatic. An expired certificate produces a full-page browser warning that costs more trust than never having had one.
