HTTPS (Hypertext Transfer Protocol Secure)
The secure version of HTTP, where all communication between the browser and the website is encrypted.
Detailed Explanation
HTTPS uses the TLS (Transport Layer Security) protocol to encrypt the connection. This prevents 'man-in-the-middle' attacks where a hacker could intercept your data (like passwords or credit card numbers). Beyond security, HTTPS is a requirement for modern browser features like Service Workers and Geolocation, and it is a significant ranking factor for SEO.
Quick Summary
HTTPS is HTTP wrapped in TLS, encrypting and authenticating every byte between browser and server. It's table stakes for the modern web, required by browsers for most APIs, demanded by search ranking, and free to provision via Let's Encrypt.
Key Takeaways
- TLS provides three things at once: confidentiality (encryption), integrity (tamper detection), and authenticity (you're talking to the real server).
- Modern HTTPS uses TLS 1.3 (preferred) or TLS 1.2; older versions are deprecated and insecure.
- Browsers block many APIs (Service Workers, Geolocation, getUserMedia, HTTP/2) on plain HTTP.
- Certificates: Let's Encrypt and cloud providers issue free, automated certs, there's no reason to be on HTTP in 2026.
- HSTS header tells browsers "always use HTTPS for this domain," preventing protocol downgrade attacks.
When to use it
- Every public website, full stop.
- Internal services where credentials, tokens, or PII traverse a network you don't fully trust.
- API endpoints (mobile clients, server-to-server), TLS auth and encryption matter just as much off the browser.
- Webhooks, where the receiving server needs to trust the message hasn't been tampered with.
Common Mistakes
- Mixing HTTP assets into an HTTPS page, browsers block the request and the page partially fails.
- Skipping HSTS, leaving users vulnerable to SSL stripping on the first visit.
- Letting certificates expire because nobody automated renewal.
- Terminating TLS at the edge and using plain HTTP inside the cluster on a network you don't fully control.
HTTPS (Hypertext Transfer Protocol Secure), Frequently Asked
Is HTTPS slower than HTTP?
Negligibly. TLS 1.3 added a 1-RTT handshake (0-RTT with session resumption) and modern CPUs have AES instructions. HTTP/2 and HTTP/3, both effectively HTTPS-only, often make HTTPS faster than plain HTTP because of multiplexing and header compression.
Do I need to pay for an SSL certificate?
No. Let's Encrypt issues free 90-day certificates with full automation; cloud providers (AWS ACM, Cloudflare, GCP) include them with their services. Paid certs offer extended validation and brand visibility but no security difference for typical sites.
What's the difference between HTTPS and HTTP/2?
HTTPS is HTTP over TLS. HTTP/2 is a version of HTTP with multiplexed streams, header compression, and server push, all browsers require HTTPS to use it. They solve different layers but ship together in practice.