HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP in which web traffic is encrypted and the website is authenticated using the TLS protocol.
How HTTPS works
HTTPS is ordinary HTTP sent inside a TLS connection, by default on TCP port 443 (originally described in RFC 2818). When a browser opens an https:// address, it performs a TLS handshake, checks that the server’s digital certificate is valid for that domain and signed by a trusted certificate authority, and then exchanges encrypted requests and responses. The padlock icon indicates that this check succeeded. HTTP/3 carries the same protection over QUIC.
Why HTTPS matters
Without encryption, anyone on the network path – a public Wi-Fi user, a compromised router or an ISP – can read and modify traffic. In 2010 the Firesheep browser extension showed how easily session cookies could be stolen from unencrypted sites on shared Wi-Fi. HTTPS protects passwords, cookies and form data and prevents injection of ads or malware into pages. Since 2018 Chrome has labelled plain HTTP pages “Not secure”, and free certificates from Let’s Encrypt helped make HTTPS the default for the vast majority of web traffic.
HTTPS has limits, however:
- It proves only that you are connected to the domain in the address bar – phishing sites use valid certificates too.
- SSL stripping, demonstrated with the sslstrip tool in 2009, downgrades users to HTTP in a man-in-the-middle attack if a site does not enforce HTTPS.
- It does not protect data once it reaches a compromised server or browser.
Best practices
- Serve every page over HTTPS and redirect HTTP requests.
- Enable HTTP Strict Transport Security (HSTS, RFC 6797) and consider HSTS preloading.
- Mark cookies as Secure and avoid mixed content.
- Users should check the domain name, not just the padlock.
