What is HTTPS?
HTTPS is HTTP with a lock on it. Before any page is sent, the browser and the server perform a handshake using TLS (Transport Layer Security, the successor to SSL): the server proves its identity with a certificate issued by a trusted authority, the two agree on encryption keys, and from then on every request and response is scrambled in transit. A visitor sees a padlock in the address bar, or rather sees no warning, since browsers now flag the absence rather than the presence.
The certificate is the piece people deal with. It ties the domain to the site's owner, is issued for a fixed period, and has to be renewed or the lock turns into a full-page warning. Since Let's Encrypt made certificates free and automatic in 2015, there has been no good reason for any site to be without one, and most hosts issue and renew them without being asked.
Why it matters
Why HTTPS matters
Three reasons, and the first is trust. Browsers mark plain HTTP pages as not secure, which for a brand selling anything, or simply asking for an email address, is the wrong first impression. The second is safety: without encryption, anyone on the same network, from a coffee shop to an internet provider, can read what a visitor types and inject content into the page. The third is reach: search engines have used HTTPS as a ranking signal for years, and many modern browser features, from location to camera to the faster HTTP/2 protocol, only work on secure pages.
In practice
How HTTPS works in practice
- 01
Setting it up is now mostly a checkbox at the host, which issues a certificate, installs it and sets it to renew. The work that remains is the migration: every page on the site has to redirect from http to https with a 301, every internal link and image path has to be updated so no secure page loads an insecure asset (the mixed content warning), and the sitemap, the analytics property and the search console have to be told about the new address.
- 02
Afterwards it is maintenance. Certificates expire, and an expired one takes the site down as surely as a server failure, so renewal is automated and monitored. HSTS, a header that tells browsers to only ever use HTTPS for the domain, closes the last gap. And when a third-party script or an embedded video is added, it is checked to make sure it loads securely too.
Watch out
What people get wrong about HTTPS
Believing the padlock means the site is trustworthy. It means the connection is private and the certificate matches the domain; a scam site can have a perfect certificate. Second, installing a certificate and declaring the job done while half the images still load over HTTP and the browser shows a warning anyway. Third, letting the certificate lapse: the most common cause of a sudden red warning across a whole site is a renewal that nobody was watching.
And a quieter one: buying an expensive certificate for a brand site when a free, automated one gives exactly the same encryption.
