What is HTTPS?
Author: Domeny.ForSale editorial team Published
In brief: HTTPS is a way for a browser to communicate with a website that encrypts the data being transmitted and helps confirm that you are connecting to the correct server for a given domain. Among other things, it protects passwords, forms and response content from being intercepted or altered in transit. However, it does not guarantee that the website itself is trustworthy — a fraudulent website can also use HTTPS.
How does HTTPS work, and how does it differ from HTTP?
HTTP is a protocol: a set of rules for sending requests and responses between a browser and a server. For example, the browser requests a product page, and the server sends back its content. Ordinary HTTP does not encrypt this communication.
HTTPS is HTTP protected by TLS — a protocol that secures the connection. Before transmitting the actual data, the browser and server agree on the security parameters, and the browser checks the certificate presented by the server. Communication is then encrypted.
HTTPS provides three fundamental properties:
- Confidentiality: someone monitoring network traffic cannot simply read the content being transmitted.
- Integrity: changes to data during transmission will be detected.
- Server authentication: the browser checks whether the certificate is trusted and matches the domain being visited.
For example, when you log in to a shop over public Wi-Fi, HTTPS protects your password as it travels from your browser to the server handling the connection. With ordinary HTTP, someone with the necessary access to network traffic could read the transmitted data. However, HTTPS will not protect your password from malicious software running on your device.
What is an HTTPS certificate used for?
A digital certificate links a domain name to a public key used to secure the connection. It is typically issued by a certificate authority: an organisation that browsers trust within the certificate system. Among other things, the browser checks that the domain name matches, that the certificate is within its validity period, and that its chain of trust is valid.
Hosting offers still often use the term “SSL certificate”. This is a common informal name: modern HTTPS connections use TLS, the successor to the obsolete SSL protocol. The certificate alone is not enough — the server must also handle encrypted connections correctly.
A basic domain-validated certificate confirms control over a domain, not the trustworthiness of its owner. Both free and paid certificates are available. The price alone does not indicate stronger encryption; differences may concern the scope of verification, the names covered or support. Check the hosting provider’s or issuer’s documentation for current issuance and renewal terms.
What does HTTPS not guarantee?
A secure connection is not the same as a trustworthy business or offer. A fraudster can register a domain similar to a bank’s address and obtain a valid certificate for it. The connection to that website will be encrypted, but any data entered will go to the fraudster.
HTTPS also does not prevent every data leak. It does not fix application vulnerabilities, automatically protect the database on the server, or stop the website owner from misusing the information they receive. It secures transmission, not the entire data-processing workflow.
Nor does it provide complete anonymity. The network operator may be able to see the server’s IP address, the time of the connection and the volume of traffic, and, depending on the technologies used, the name of the domain being visited. However, HTTPS encrypts the URL path, query parameters and the content of the communication. Visibility of the domain therefore does not automatically mean visibility of the specific article being read.
How can you check a connection and respond to warnings?
Check whether the address begins with https://, and open the connection information next to the address bar. The icon’s appearance depends on the browser — it is not always a padlock. Security information refers to the connection, not an assessment of the trustworthiness of the website’s content.
Before entering a password or payment details, read the domain name carefully. In the address bank.example.com, the parent domain is example.com; the word “bank” alone does not prove any connection to a bank. Likewise, a logo and the appearance of a form can be copied.
If your browser warns you about an invalid certificate or an unsecured connection, do not bypass the warning to log in. The cause could be a configuration error, an incorrect date on your device or a network problem, but you cannot determine this without checking. Verify the address and your device’s clock, and contact the website administrator if necessary.
How can you enable HTTPS on your own website?
The easiest place to start is your hosting control panel: many providers offer certificate issuance and automatic renewal. Check the official documentation to confirm which domains the service covers and whether it requires additional configuration. Enabling the certificate is only the beginning of checking your implementation.
- Make sure the certificate covers the names you use, such as the main domain and the version with
www, if you support it. - Enable HTTPS and test the website, especially login, forms, payments and integrations.
- Set up permanent redirects from HTTP to HTTPS, preserving the paths to individual pages.
- Change resource URLs to HTTPS. Images, scripts or styles loaded over HTTP create what is known as mixed content; the browser may block these resources or attempt to load them securely.
- Update the website address in your CMS, internal links and the sitemap, then check that certificate renewal works.
Once the configuration is stable, you can implement HSTS — a mechanism that instructs the browser to use HTTPS for subsequent connections. This requires care, especially when including subdomains, because incorrect settings can make services difficult to access.
Run your first practical test on your website’s most important form: check that the connection is secure, that there are no warnings, and that accessing it over HTTP correctly redirects to HTTPS.
See also: What is a CDN?
Read also
