The difference in one sentence
MDN defines HTTPS as an encrypted version of the HTTP protocol: it uses TLS, Transport Layer Security, to encrypt all communication between a client and a server. HTTP sends pages, form data and cookies as plain text that every router, Wi-Fi access point and provider on the path can read; HTTPS wraps the same exchange so that only the two ends can.
What HTTPS protects
Google's web.dev gives three reasons, and they map onto three different attacks:
| Protection | What it stops | Example |
|---|---|---|
| Privacy | Passive eavesdropping on the traffic | Someone on the same café Wi-Fi reading the pages you open and the forms you submit |
| Integrity | Tampering by an intermediary | A provider injecting ads or a script into pages on the way to the browser, which web.dev names as a real case |
| Authentication | Impersonation of the server | The certificate ties the connection to the domain in the address bar, so a redirect to a look-alike server fails the check |
The certificate is the part people see: a file the server presents, issued by a certificate authority after it verified control of the domain, with an expiry date. The SSL checker reads a site's certificate and reports the issuer, the names it covers and the days left; an expired or mismatched certificate turns the padlock into a warning page.
What HTTPS does not protect
- The site itself. Encryption says nothing about who is on the other end or what they do with your data. A phishing page can carry a valid certificate; the padlock confirms the domain, so read the domain.
- What you send on purpose. The server receives your data in the clear once the connection is decrypted. HTTPS protects the trip, not the destination.
- Which sites you visit. The destination hostname is usually still visible to the network, even though the pages are not.
- Mixed content. An HTTPS page that loads a script or image over plain HTTP gives the attacker a way back in; browsers block or warn about it, and the HTTP header checker shows the security headers a site sends to prevent it.
The features that need HTTPS
Browsers restrict their most powerful APIs to secure contexts. MDN defines a secure context as a document delivered over HTTPS or from a loopback address, and lists which URLs qualify: an https address, http://localhost and a file URL are secure, a plain http address is not. The reasoning is direct: features that can invade a user's privacy or reach their hardware would be exploitable by anyone in the middle of an unencrypted connection. web.dev names the camera and microphone, offline service workers and progressive web apps as capabilities that need HTTPS, and notes that older APIs such as geolocation are being moved to the same rule. In practice, if a page cannot use the camera or install as an app, the first thing to check is the scheme; the microphone and webcam guide starts there.
Switching a site to HTTPS
- Get a certificate from a certificate authority, which most hosts and CDNs now provision automatically and renew for you. Check the result with the SSL checker: the names covered must include both the bare domain and www if you use both.
- Serve everything over HTTPS: pages, images, scripts, fonts, embedded iframes. Any http:// reference in your own HTML becomes mixed content.
- Redirect HTTP to HTTPS with a permanent redirect so that old links and bookmarks land on the secure address; the redirect generator produces the server rule, and the HTTP status codes guide explains why 301 or 308 is the right code.
- Update the canonical URLs, the sitemap and any hardcoded links to the https version, so search engines consolidate on one address.
- Add the security headers, above all Strict-Transport-Security, which tells browsers to use HTTPS for the domain from then on. The header checker shows what the site sends.
- Re-test performance. The website speed test runs against the https address and shows what actually takes the time.
Reading the address bar
| What you see | What it means |
|---|---|
| https:// with a padlock or a neutral icon | The connection is encrypted and the certificate matches the domain |
| "Not secure" or no padlock | Plain HTTP; anything you type can be read on the way |
| A full-page certificate warning | The certificate is expired, for another domain, or not trusted; do not proceed on a site you care about |
| https:// on a site you do not recognise | Encrypted, but that says nothing about the operator; check the domain spelling |
Frequently asked questions
What is the difference between HTTP and HTTPS?
The S. HTTPS is, in MDN's words, an encrypted version of the HTTP protocol that uses TLS to encrypt all communication between a client and a server. The pages, forms and scripts are the same; what changes is that nobody between your browser and the server can read or alter the traffic.
Does HTTPS make a website trustworthy?
It makes the connection trustworthy, not the site. HTTPS guarantees that you are talking to the server named in the address bar and that nobody changed the bytes on the way. A scam site can have a perfectly valid certificate. Judge the site by who runs it; judge the padlock by whether the domain is the one you meant.
Why do some features only work on HTTPS?
Because browsers restrict powerful features to secure contexts. MDN explains that APIs which can access the camera and microphone, register service workers or read sensitive data would be dangerous over a connection an attacker can tamper with, so they are only available on pages served over HTTPS, from localhost or from a local file.
Is HTTPS slower?
Not noticeably on modern servers and browsers; the encryption cost is small compared with the images and scripts a page loads. A slow site is slow for other reasons, which the website speed test shows.
Do I need to redirect HTTP to HTTPS?
Yes. Once the certificate is in place, every http:// address should answer with a permanent redirect (301 or 308) to the https:// version, so old links, bookmarks and typed addresses land on the secure page and search engines treat the two as one site. The redirect generator writes the rule for your server.
Sources
- MDN Web Docs: HTTPS (an encrypted version of HTTP that uses TLS to encrypt all communication between client and server)
- MDN Web Docs: Secure contexts (HTTPS, localhost and file URLs count as secure; powerful APIs such as service workers are limited to them)
- web.dev (Google): Why HTTPS matters (protects integrity against tampering by intermediaries, protects privacy against eavesdropping, and is required for features such as camera access and service workers)