Glossary / HTTPS

What is HTTPS

HTTPS is the secure version of HTTP, the protocol a browser uses to exchange data with a website. The S means the connection is encrypted with TLS, so passwords, payments, and personal data cannot be intercepted. Today HTTPS is the standard for every site, not just shops or banks.

Plain HTTP sends everything as clear text, so anyone between you and the site can read or alter the data. HTTPS adds a TLS layer on top that encrypts the traffic and confirms you are talking to the real site, not an impostor.

To run HTTPS a site needs an SSL certificate. When it is in place, the browser shows the padlock and an https address, and the page loads over port 443 instead of 80.

HTTPS affects more than security. Google has long used it as a ranking signal, modern browser features only work over https, and sites without it are labeled as not secure.

Example

https://example.com  (port 443, HTTP/2)

Common mistakes

• Thinking HTTPS guarantees the site is honest. It encrypts the channel, but a scam site can also have a certificate and a padlock.
• Enabling HTTPS but leaving links to http resources on the page, which causes mixed content and drops the padlock.
• Not setting up a redirect from http to https, so the old unencrypted version stays reachable.

Related terms

• SSL certificate What is an SSL certificate
• TLS What is TLS
• wildcard certificate What is a wildcard certificate
• Let's Encrypt What is Let's Encrypt
• certificate chain What is a certificate chain