HTTPS

HTTPS (HyperText Transfer Protocol Secure) is the secure, encrypted variant of the HTTP protocol. All communication between browser and server passes through the cryptographic TLS layer (formerly SSL), so the data sent — passwords, personal details, card numbers — is unreadable to outsiders. HTTPS runs on port 443 by default and is today the standard protocol of the web.

How HTTPS works

HTTPS provides three security guarantees: confidentiality (data is encrypted), integrity (it cannot be silently altered in transit) and authentication (the certificate confirms you are connecting to the right server, not an impostor). Establishing the connection is preceded by a TLS handshake:

1. Browser and server negotiate the protocol version and the set of encryption algorithms.
2. The server presents a certificate, which the browser verifies against trusted certificate authorities.
3. The two sides agree on a session key used to symmetrically encrypt the rest of the communication.

The whole process takes milliseconds and is invisible to the user, who only sees a padlock symbol in the address bar. HTTPS is complemented by the HSTS mechanism, which forces connections over the encrypted channel only.

Practical application

HTTPS is a mandatory standard for any site handling user data — stores, contact forms, login panels — and browsers mark unencrypted sites as not secure. Deployment comes down to installing a certificate on the server; the free Let's Encrypt certificates offered in hosting panels have made HTTPS available at no extra cost. Beyond security, HTTPS is also a prerequisite for using newer, faster protocol versions such as HTTP/2.