HTTPS
HTTPS is HTTP with a layer of cryptographic encryption, keeping passwords and user data safe from eavesdroppers.
Diagram
Client Server ────── ────── │ TLS Handshake │ │──────── Hello ──────────────▶│ │◀─────── Certificate ─────────│ (identity proof) │──────── Session Key ────────▶│ (encrypted key exchange) │ │ │ All further traffic is │ │ encrypted with session key │ │◀─────────────────────────────▶│
In Depth
HTTPS stands for HyperText Transfer Protocol Secure. It is simply standard HTTP traffic wrapped inside a secure, encrypted tunnel managed by the TLS (Transport Layer Security) protocol.
Code Example
Security headers enforced over HTTPS
HTTP/2 200 OK Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: default-src 'self' X-Frame-Options: DENY
Common Misconception
HTTPS does not mean a website is safe to trust. A malicious or scam website can easily obtain a free TLS certificate and run over HTTPS. It only means the connection is encrypted, not that the content is honest.
Real World Usage
All payment transactions, logins, and API transfers require HTTPS. Search engines down-rank pages that do not implement HTTPS, and modern browsers display active security warnings on standard HTTP links.
Related Terms