HTTP vs HTTPS
Also known as: HTTPS, HTTP, SSL, TLS, Secure HTTP
HTTP and HTTPS are both protocols your browser uses to communicate with websites.
The difference is that HTTPS adds a layer of encryption that protects the data travelling between your device and the website. When you see a padlock icon in your browser's address bar, it means the site is using HTTPS and your connection is encrypted.
Also covered here: Mixed content warning · Certificate error · HTTP to HTTPS redirect
What it looks like
HTTP vs HTTPS, explained at three levels
At home
HTTP is the basic method your browser uses to request and receive web pages. HTTPS does the same thing but adds encryption, which scrambles the data so that nobody can read it while it travels between your device and the website. You can tell a site uses HTTPS by the padlock icon in the address bar — this means your connection is private and secure.
At work
HTTPS is now the expected standard for any business website or web application. It ensures that data exchanged between employees, customers, and company systems is encrypted in transit, protecting sensitive information from interception. Browsers prominently warn users when a site uses HTTP instead of HTTPS, which can damage customer trust and brand credibility. Any organisation operating a website should ensure HTTPS is enabled across every page, not just login or payment pages.
At home
HTTP sends data in plain text, meaning anyone monitoring the network (on public Wi-Fi, for example) could read the content of your requests and the responses. HTTPS wraps that communication in TLS (Transport Layer Security) encryption using a digital certificate issued by a Certificate Authority. The browser and server perform a TLS handshake to establish an encrypted session before any data is exchanged, ensuring confidentiality and data integrity throughout the connection.
At work
Implementing HTTPS requires obtaining a TLS certificate from a trusted Certificate Authority (CA) — services like Let's Encrypt provide these for free with automated renewal. Certificates must be properly configured with the correct Subject Alternative Names (SANs) and renewed before expiration to avoid browser warnings. For enterprise deployments, certificate lifecycle management tools automate provisioning, renewal, and revocation across hundreds of domains and subdomains, integrating with load balancers and CDN platforms.
At home
TLS 1.3 (the current standard) reduced the handshake to a single round trip (1-RTT), improving performance over TLS 1.2's two-round-trip handshake. It removed support for older, vulnerable cipher suites (RC4, 3DES, CBC-mode ciphers) and mandates forward secrecy, meaning that even if a server's private key is later compromised, past session data remains protected. HSTS (HTTP Strict Transport Security) headers instruct browsers to only connect via HTTPS, and HSTS preload lists hardcode this policy into the browser itself for enrolled domains.
At work
Enterprise HTTPS deployment at scale involves terminating TLS at the load balancer or CDN edge (offloading cryptographic processing from origin servers), pinning certificates in mobile applications to prevent MITM attacks via rogue CAs, and monitoring Certificate Transparency (CT) logs for unauthorised certificate issuance against company domains. OCSP stapling improves revocation checking performance by having the server provide a signed, timestamped revocation status directly. Organisations in regulated industries must ensure TLS configuration meets compliance requirements — PCI DSS, for example, mandates TLS 1.2 or higher for cardholder data transmission.
Real-world examples
At home
When Fatima logs into her online banking, she notices the padlock icon and 'https://' in the address bar. This means her username, password, and account details are encrypted as they travel between her laptop and the bank's server — even if someone on the same coffee shop Wi-Fi tried to intercept the data, they would only see scrambled, unreadable information.
At work
When David's company launches a new customer portal, the IT team ensures HTTPS is configured with a trusted certificate and HSTS headers before go-live. This guarantees that all customer data — login credentials, personal details, and support tickets — is encrypted in transit, meeting both security best practices and the company's compliance requirements.
How it compares
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | None — data sent in plain text | TLS encryption protects all data in transit |
| Browser indicator | Marked 'Not Secure' in most browsers | Shows padlock icon indicating a secure connection |
| Data integrity | Data can be altered in transit without detection | TLS ensures data cannot be tampered with undetected |
| Authentication | No way to verify the server's identity | Digital certificate confirms the site's identity |
| Performance | Marginally faster (no handshake overhead) | Negligible difference with TLS 1.3; HTTP/2 requires HTTPS |
| SEO impact | May be ranked lower by search engines | Preferred by Google and other search engines for ranking |
| Use case today | Effectively obsolete for public websites | The standard for all websites and web applications |
HTTPS is simply HTTP with encryption added. It protects data in transit, verifies the website's identity, and is now the universal standard. There is no good reason for any website to use plain HTTP today.
For analysts
If you are writing requirements for any web-facing project, HTTPS should be a non-negotiable baseline, not a feature request. Make sure the requirements include certificate management, automatic HTTP-to-HTTPS redirection, and HSTS headers. If the project involves a third-party integration, confirm that the third party supports HTTPS endpoints — accepting plain HTTP connections for data exchange is a red flag.
History & origin
HTTP was created by Tim Berners-Lee in 1991 as the communication protocol for the World Wide Web. HTTPS was introduced by Netscape in 1994 to enable secure online transactions, initially for e-commerce. For years, HTTPS was used only on pages handling sensitive data like payments, but from around 2017 onward, major browsers began marking all HTTP sites as 'Not Secure,' pushing the entire web toward HTTPS as the default.