HTTP
HTTP vs HTTPSWhat the S changes
HTTPS is HTTP carried inside a TLS session. The requests and responses are identical; TLS adds encryption (nobody on the path can read them), integrity (nobody can alter them) and authentication (the server proves its identity with a certificate). HTTP uses port 80, HTTPS uses port 443, and browsers now treat plain HTTP as "Not secure".
Same protocol, different transport
HTTP defines requests (GET /page HTTP/1.1, headers, body) and responses (status codes, headers, body). HTTPS does not change any of that. It wraps the entire exchange in a TLS session established before the first byte of HTTP is sent.
| HTTP | HTTPS | |
|---|---|---|
| URL scheme | http:// | https:// |
| Default port | 80 | 443 |
| Transport | TCP | TLS over TCP (HTTP/1.1, HTTP/2) or QUIC over UDP (HTTP/3) |
| Content readable on the path | Yes, entirely | No |
| Content modifiable on the path | Yes (injected ads, malware, altered downloads) | No |
| Server identity | Unverified | Verified by certificate |
| Browser indicator | "Not secure" | Padlock or neutral |
| HTTP/2 and HTTP/3 | Not supported by browsers | Supported |
What HTTPS protects
- Confidentiality: URLs (path and query), headers, cookies, form data and page content are encrypted.
- Integrity: any modification in transit is detected and the connection fails.
- Authentication: the certificate binds the server's public key to its domain name, verified by a certificate authority the browser trusts.
What HTTPS does not protect
- Which server you connect to. The IP address is visible, and the server name usually appears in the TLS ClientHello (SNI). Encrypted Client Hello (ECH) hides it where deployed.
- How much and when. Traffic volume and timing leak information.
- The server itself. HTTPS says nothing about the security of the application or the honesty of its operator.
- The DNS lookup that preceded the connection, unless DoH/DoT is used.
Certificates
A certificate is issued by a certificate authority after it verifies control of the domain (usually via an HTTP file on port 80 or a DNS record). Let's Encrypt and other ACME providers issue them free and automatically with 90-day lifetimes. Expiry is the single most common cause of HTTPS outages; automate renewal and monitor it.
Migrating a site to HTTPS
- Obtain and install a certificate for every hostname (including www).
- Serve the site on 443; test with
curl -vI https://example.com/. - Fix mixed content: update asset URLs to
https://or protocol-relative. - Redirect HTTP to HTTPS with a 301 on every URL.
- Update canonical tags, sitemaps and internal links.
- Add
Strict-Transport-Security: max-age=31536000; includeSubDomainsonce everything works. - Update external references where possible (search console properties, ads, integrations).
Checking a site
curl -vI https://example.com/ 2>&1 | findstr /i "subject: issuer: expire SSL TLS HTTP/"The output shows the negotiated TLS version, certificate subject, issuer and expiry, and the HTTP version used. The TLS vs SSL record covers protocol versions.
Frequently asked questions
Does HTTPS make a website trustworthy?
It proves you are talking to the server named in the certificate and that nobody altered the content in transit. It says nothing about whether that server is honest. Phishing sites use HTTPS too.
Is HTTPS slower than HTTP?
The TLS handshake adds one round trip (TLS 1.3) at connection start. In exchange, HTTPS enables HTTP/2 and HTTP/3, which are faster than HTTP/1.1 for typical pages. Net effect on a modern site: HTTPS is faster.
What is mixed content?
An HTTPS page that loads scripts, styles or images over plain HTTP. Browsers block mixed scripts and upgrade or block mixed images. Fix by serving every asset over HTTPS.
What does HSTS do?
The Strict-Transport-Security header tells browsers to use HTTPS for the domain for a set period, even if the user types http://. It prevents downgrade attacks on the first request and stops users from clicking through certificate warnings.