Hypertext Transfer Protocol Secure (HTTPS)

Security Glossary - SSL/TLS

Definition: HTTPS is HTTP layered over a TLS connection. It provides encrypted communication and secure identification of a web server, preventing eavesdropping and tampering with data in transit. HTTPS URLs begin with https:// and typically use port 443.

The Essentials

HTTP layered over TLS for encrypted communication
Uses port 443 by default
Required for HTTP/2 and HTTP/3 performance benefits
Google ranking signal since 2014
Browsers display Not Secure warning for plain HTTP

Why You Should Care About HTTPS

HTTPS is no longer optional for any website. Every major browser marks plain HTTP sites with a visible "Not Secure" warning in the address bar, which immediately damages user trust. Google confirmed HTTPS as a ranking signal, and HTTP/2 and HTTP/3 - which provide significant performance improvements - require HTTPS.

Beyond the ranking and trust benefits, HTTPS prevents a range of attacks. Without it, anyone on the network path (ISPs, Wi-Fi hotspot operators, or attackers) can read and modify the traffic. This means they could inject ads, malware, or tracking scripts into your pages, redirect users to phishing sites, or steal session cookies to hijack accounts.

For sites that use any form of authentication, handle any user data, or set cookies, HTTPS is essential. Even for purely static informational sites, the browser warning alone is reason enough. The HSTS header and HSTS preload list take this further by preventing any HTTP connection attempts.

How to Test for HTTPS

Check that your site loads over HTTPS by visiting it in a browser and confirming the lock icon appears. Use an SSL checker to verify the certificate is valid and the server redirects HTTP to HTTPS. Also verify that no mixed content warnings appear - these happen when an HTTPS page loads resources over plain HTTP.

Check SSL Certificate

Clearing Up Confusion

Myth: HTTPS makes my website completely secure

Reality: HTTPS only secures data in transit. It does not protect against XSS, SQL injection, CSRF, or server misconfigurations. It is one layer in defense-in-depth.

Myth: HTTPS significantly slows down my website

Reality: With TLS 1.3 and modern hardware, the overhead is negligible. HTTPS is required for HTTP/2, which actually improves performance through multiplexing and header compression.

Questions and Answers

Does HTTPS make my website completely secure?

No. HTTPS secures data in transit between the browser and server, but it does not protect against application-level vulnerabilities like XSS, SQL injection, or server-side misconfigurations. It is one layer in a defense-in-depth strategy.

Will switching to HTTPS affect my SEO?

Switching to HTTPS with proper 301 redirects from HTTP to HTTPS should improve or maintain your SEO. Google uses HTTPS as a positive ranking signal. Make sure to update your canonical URLs, sitemap, and internal links to use HTTPS.