HTTPS (Hypertext Transfer Protocol Secure) is HTTP transported over a TLS-encrypted connection. It provides two guarantees: (1) confidentiality — data is encrypted in transit, (2) authentication — the server’s TLS certificate proves it controls the domain.
How HTTPS Works
Browser connects to example.com:443
↓
TLS handshake: verify certificate, negotiate encryption
↓
Encrypted HTTP requests and responsesWithout HTTPS, all data (passwords, cookies, form submissions) travels as plaintext — readable by anyone on the network path (ISP, Wi-Fi operator, nation-state).
HTTPS vs HTTP
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | None | TLS encryption |
| Authentication | None | Server identity verified |
| Port | 80 | 443 |
| SEO | Ranked lower | Google ranks higher |
| Browser warning | None (modern Chrome shows “Not secure”) | Padlock icon |
Getting HTTPS
Any publicly trusted CA can issue a certificate. Let’s Encrypt is free and provides automated renewal via ACME. Cloudflare provides HTTPS for any proxied site with zero configuration.
HTTPS Limitations
HTTPS does not mean the site is safe or legitimate. Phishing sites use HTTPS with valid certificates. The padlock means the connection is encrypted — always verify the domain itself, not just the security indicator.