# Facilitator guide: How does a website reach your screen? 40 minutes · First-time learners. No technical background needed. **Goal:** Learners separate four jobs that happen in one website visit: finding an address, protecting a connection, receiving content, and reusing a saved copy. ## Lessons used - What is DNS? Follow a website name to its address: https://noobquestions.com/dns-explained-how-a-website-finds-its-address/ - Why is this page still old? Web caching explained: https://noobquestions.com/why-a-website-still-shows-an-old-page-cache-explained/ - What does HTTPS protect? A padlock is not a trust guarantee: https://noobquestions.com/https-explained-a-padlock-is-not-a-trust-guarantee/ ## Before you start - Open the DNS lesson on a shared screen, or ask learners to open it on their own device. - Open the pretend cache in the Learning Lab (/lab/), experiment 02. - Print one worksheet per learner, or share the download. ## Run of show - **0–5 min · Warm-up:** Ask: “You type example.com and press Enter. What happens before you see the page?” Learners write a guess on the worksheet (question 1). Don’t correct anyone yet. - **5–15 min · Predict, then click:** Step through the DNS click-through together. Before each click, learners call out which job comes next: find the address, protect the connection, or receive the page. - **15–25 min · Change one thing:** Run the pretend cache: load, update the original, load again, wait twice, load. Before each load, ask: “Will this come from the saved copy or the original?” - **25–35 min · Spot the trap:** Show the HTTPS lesson’s lookalike-site example. Discuss: what does the padlock protect, and what does it not prove? - **35–40 min · Explain it back:** Learners answer the exit question in their own words, without copying a definition. Collect a few answers aloud only if people volunteer. ## Answer guidance 1. **Before the lesson: list what you think happens between pressing Enter and seeing a page.** Any answer is fine. Compare it with question 6 at the end so learners can see what changed. 2. **What does a DNS lookup give your browser?** An address (for an ordinary website visit, an IP address) the browser can use to connect. It does not return the page. 3. **True or false: once the DNS lookup succeeds, the page has already downloaded. Explain.** False. Finding the address, connecting, and requesting content are separate jobs. The lookup only answers where to go. 4. **In the pretend cache, you updated the original page but still saw version 1. Why?** The saved copy was still within its freshness period (30 seconds in the model), so it was reused without asking the original. Stale does not automatically mean broken. 5. **A lookalike website shows a padlock. What does HTTPS protect, and what does it not prove?** HTTPS protects the connection so others on the path can’t read or change what is sent. It does not prove the site is honest, or that it is the site you meant to visit. Read the address, not the page design. 6. **Exit question: put these in order and explain each in one line — receive the page, find the address, protect the connection.** Find the address → protect the connection → receive the page. Accept any answer that keeps the three jobs separate. ## Common misconceptions - “DNS sends me the website.” It only finds the address. - “Refresh always fetches a fresh copy.” A cache can reuse a saved copy while it is considered fresh. - “Padlock means safe.” It means a protected connection to that address, whoever runs it. ## Sources to check - MDN: What is a domain name?: https://developer.mozilla.org/en-US/docs/Learn_web_development/Howto/Web_mechanics/What_is_a_domain_name - MDN: HTTP caching: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Caching - MDN glossary: HTTPS: https://developer.mozilla.org/en-US/docs/Glossary/HTTPS - Mozilla: What HTTPS does and does not protect: https://blog.mozilla.org/en/firefox/https-protect/ ## Notes - The lessons are simplified teaching models. Check the sources before changing a real system. - Don’t collect learner data you don’t need. Never ask anyone to enter a real password, code or workplace detail. - These plans haven’t been evaluated in a classroom. - No reuse licence has been set. Please ask before republishing or redistributing.