Every time someone visits your website, a small padlock in the browser promises that the connection is private. That promise rests on maths that today’s computers cannot crack. A big enough quantum computer could. Post-quantum cryptography is the fix the internet is rolling out right now, and a lot of it has already reached your visitors without anyone making a fuss.
This guide explains post-quantum cryptography in plain English: what it is, why it matters years before quantum computers are ready, what has already changed in 2026, and the few simple steps WordPress and Elementor site owners should take.
What is post-quantum cryptography?
Post-quantum cryptography (often shortened to PQC) is a family of new encryption methods designed to stay safe even against powerful quantum computers. It runs on normal computers, phones and servers. You do not need quantum hardware to use it.
Today, most of the web relies on two older families of maths:
- RSA, which depends on how hard it is to split huge numbers into their factors.
- Elliptic curve cryptography (ECC), which powers the fast key exchange behind most HTTPS connections.
A large, error-corrected quantum computer running a method called Shor’s algorithm could solve both problems quickly. Post-quantum algorithms are built on different maths problems, mostly “lattices” and error-correcting codes, where no fast quantum shortcut is known.
Think of it like changing the locks on a building before a new kind of master key is invented. The doors look the same. Only the lock inside is different.
Why it matters now, not in 2040
Nobody has a quantum computer that can break real encryption today. Expert estimates for when one might arrive range widely, roughly from the early 2030s to the mid 2040s. So why are browsers and hosting companies changing things now?
The answer is a risk called “harvest now, decrypt later.” An attacker can record encrypted traffic today, store it cheaply, and wait. Once a capable quantum computer exists, they can unlock the old recordings. For anything that must stay private for years, such as medical details, legal messages, customer records or business plans, the danger already exists.
Governments have also set deadlines. In its draft transition plan (NIST IR 8547), the US National Institute of Standards and Technology says common RSA and elliptic curve methods will be deprecated after 2030 and disallowed after 2035. Large migrations take years, so the work has started early.
The new standards in simple terms
In August 2024, NIST published the first three finished post-quantum standards. In March 2025 it picked a fifth algorithm as a backup. Here is what each one does:
| Standard | Name | What it does | Status |
|---|---|---|---|
| FIPS 203 | ML-KEM | Agrees on a secret key for encrypted connections (HTTPS, VPNs, SSH) | Final, August 2024 |
| FIPS 204 | ML-DSA | Digital signatures, for example proving a website or software update is genuine | Final, August 2024 |
| FIPS 205 | SLH-DSA | Backup signature method built on hash functions | Final, August 2024 |
| FIPS 206 (draft) | FN-DSA | Compact signatures based on the Falcon algorithm | In progress |
| HQC | HQC | Backup key method built on error-correcting codes, in case ML-KEM ever shows a weakness | Selected March 2025; draft standard expected 2026, final 2027 |
For website owners, ML-KEM is the one that matters most today. It protects the moment when a browser and a server agree on the secret key for a session.
What has already changed (you may already be protected)
The good news is that the biggest piece of post-quantum cryptography has quietly arrived on the web.
- Browsers: Chrome and Edge turned on a hybrid key exchange called X25519MLKEM768 by default from version 131 in November 2024. “Hybrid” means it combines a classic method with ML-KEM, so the connection stays safe even if one of the two is ever broken. Firefox and Apple platforms have been rolling out the same support.
- CDNs: Cloudflare reported on September 29, 2026 that about 70% of browser traffic reaching its network now uses hybrid ML-KEM. It also added a dashboard card that shows which key exchange your visitors use.
- Server software: OpenSSL 3.5, released in April 2025, supports ML-KEM. OpenSSH 10.0, also from April 2025, made a hybrid ML-KEM key exchange the default for SSH logins.
So if your WordPress site sits behind a modern CDN, or your host runs current server software, many of your visitors may already be on post-quantum protected connections.
What has not finished yet is the certificate side. The SSL certificates that prove your site is really yours still use classic signatures. The industry is testing post-quantum certificates, but they are larger and slower, so this part will take a few more years. That is fine: the “harvest now, decrypt later” risk mostly targets the key exchange, which is the part already being fixed.
5 steps for WordPress site owners
You do not need to be a cryptographer. These five steps cover almost everything a normal site owner can control.
- Check what your site uses today. Open your site in Chrome, press F12, go to the Security tab and look at the connection details. If you see X25519MLKEM768 in the key exchange line, your connection is already post-quantum protected. If you use Cloudflare, the new TLS key exchange card in your analytics shows the same thing for all visitors.
- Ask your host one clear question. Send a short message: “Do your servers support TLS 1.3 with the X25519MLKEM768 hybrid key exchange, and which OpenSSL version do you run?” A good host will answer quickly. If they do not support TLS 1.3 at all, that is a sign to move.
- Keep TLS 1.3 switched on and drop old versions. Post-quantum key exchange only works with TLS 1.3. In your host or CDN panel, make sure TLS 1.3 is enabled and turn off TLS 1.0 and 1.1 if they are still active.
- Keep software and plugins updated. Hosting stacks, PHP and WordPress itself get security improvements through normal updates. A site that runs current versions picks up new protections without extra work. Remove plugins you no longer use, because every outdated extension is a weak spot no matter how strong the encryption is.
- Do not fall for “quantum-proof” sales pitches. You do not need a special plugin to make your site “quantum safe.” Real post-quantum protection happens in browsers, servers and CDNs, not inside a WordPress plugin. Be careful with anyone selling a paid fix for something your host and browser already handle.
What about my visitors’ passwords and payments?
Passwords stored on your site are protected by hashing, which is a different tool. Quantum computers are not expected to break modern password hashing in a practical way, so a strong hashing setup plus two-factor login is still the right approach. Payments usually run through providers like Stripe or PayPal, which handle their own encryption upgrades on their side.
The most common ways WordPress sites get hurt in 2026 are still old plugins, weak passwords and missing backups. Post-quantum cryptography protects data in transit. It does not replace good everyday security habits.
Building sites that stay fast and secure
Strong encryption works best on a clean, lightweight site. Fewer plugins mean fewer things to update and fewer doors left open. That is one reason we build Bright Addons as a single plugin: you can find dozens of design widgets in one place instead of installing a separate plugin for each feature. Browse the full list on our widgets page, or check the docs for setup tips.
Conclusion
Post-quantum cryptography is not a distant science project anymore. The key standards are final, the major browsers use them by default, and a large share of web traffic is already protected. For WordPress site owners, the job is simple: confirm your host and CDN support TLS 1.3 with hybrid ML-KEM, keep everything updated, and ignore anyone selling a “quantum-proof” plugin. Do those things and your site will be ready for post-quantum cryptography long before quantum computers are.
FAQ
Is post-quantum cryptography needed for a small WordPress site? You do not need to do anything special. The protection comes from your browser, host and CDN. Just make sure TLS 1.3 is on and your hosting software is current.
Can quantum computers break HTTPS today? No. No existing quantum computer can break the encryption used on the web. The concern is that traffic recorded today could be decrypted in the future, which is why the upgrade is happening now.
Do I need a new SSL certificate for post-quantum security? Not yet. Post-quantum certificates are still being tested. Your current certificate is fine, and the key exchange part, which matters most today, is already being upgraded by browsers and servers.
What is ML-KEM? ML-KEM is the NIST standard (FIPS 203) that lets a browser and server agree on a secret key in a way that resists quantum attacks. Browsers use it in a hybrid mode called X25519MLKEM768.
