Cybersecurity glossary
What is HTTPS?
Learn what HTTPS is, how HTTP over TLS protects confidentiality and integrity, how certificates prove server identity, and which operational practices keep HTTPS deployments secure.
Definition
HTTPS (Hypertext Transfer Protocol Secure) is HTTP communicated over a TLS-encrypted channel so browsers and servers can exchange web data with confidentiality, integrity, and cryptographic authentication of the server’s identity via certificates.
Why HTTPS matters
The web moves passwords, cookies, personal data, and application APIs across networks you do not control. Plain HTTP exposes that traffic to anyone on the path. HTTPS wraps HTTP in TLS so eavesdroppers cannot read or casually alter content, and so clients can authenticate the server’s hostname with public-key certificates.
HTTPS is now the baseline for public websites—not a premium feature. Without it, browsers warn users, cookies leak, and entire classes of network attacks become trivial.
How HTTPS works
Client connects to port 443
The browser opens a TCP (or QUIC) connection intending to speak HTTP over TLS.
TLS handshake authenticates the server
The server presents a certificate chain; the client verifies trust and hostname binding.
Keys are established
Modern handshakes negotiate ephemeral key exchange so session keys protect the channel.
HTTP runs inside the tunnel
Requests and responses—including headers and bodies—travel encrypted and integrity-protected.
Application security continues
Authorization, XSS defenses, and business logic still apply; HTTPS does not fix app bugs.
Policy keeps users on HTTPS
Redirects and HSTS reduce accidental cleartext revisits.
What HTTPS protects—and what it does not
| Property | HTTPS role |
|---|---|
| Confidentiality on the wire | Encrypts HTTP content against network eavesdroppers |
| Integrity on the wire | Detects tampering with requests/responses in transit |
| Server authentication | Validates certificate name and chain for the destination host |
| Phishing / fake brands | Does not stop lookalike domains with their own valid certificates |
| Application flaws | Does not prevent XSS, CSRF, IDOR, or insecure business logic |
Core building blocks
TLS protocols
Prefer TLS 1.2 and TLS 1.3; disable SSL and obsolete TLS versions.
Certificates
X.509 credentials issued by trusted CAs bind public keys to hostnames.
Private keys
Must stay secret on servers or HSMs; compromise requires rotation and revocation.
Secure cookies & headers
Mark cookies Secure; add HSTS and related hardening once HTTPS is solid.
Operational checklist
- Redirect all HTTP traffic to HTTPS on every public hostname.
- Automate certificate issuance and renewal; alert before expiry.
- Use modern cipher suites and disable export/legacy options.
- Enable HSTS after confirming certificates and subdomains are ready.
- Protect private keys and limit who can change DNS used for issuance.
- Monitor Certificate Transparency for unexpected certificates on your domains.
- Ensure CDNs and load balancers terminate TLS with the same policy as origins.
- Test mobile apps and APIs for HTTPS enforcement and certificate validation.
The practical takeaway
HTTPS is HTTP over TLS: encrypted, integrity-protected web traffic with certificate-based server authentication. It is necessary for modern web safety and insufficient alone against application attacks or phishing on lookalike domains.
Deploy it everywhere, keep certificates and TLS configs healthy, and layer HSTS plus application security on top. The padlock means the pipe is protected—not that the destination is harmless.
Related security terms
SSL/TLS
The cryptographic protocols that provide the secure channel under HTTPS.
HTTP Strict Transport Security (HSTS)
A browser policy that keeps users on HTTPS after a qualifying visit.
X.509 Certificate
The credential that authenticates HTTPS servers to clients.
Certificate Authority (CA)
The issuer that vouches for public HTTPS certificates.
Man-in-the-Middle (MITM)
The attacker model HTTPS is designed to frustrate on hostile networks.
Frequently asked questions
What is HTTPS in simple terms?
HTTPS is the normal web protocol (HTTP) sent through an encrypted tunnel (TLS). It helps keep page content and passwords private on the network and helps verify you are talking to the real website.
Is HTTPS the same as SSL?
People still say SSL colloquially, but modern HTTPS uses TLS. SSL is the obsolete predecessor. Certificates are often still called SSL certificates in vendor marketing.
Does HTTPS mean a website is safe?
HTTPS protects the connection, not the site’s honesty or application security. A phishing site can have a valid certificate for its own domain.
What does the padlock mean?
It generally indicates a successfully authenticated and encrypted HTTPS connection to the name in the address bar—not that the business is trustworthy.
Do I need HTTPS for static websites?
Yes. Modern browsers treat HTTP as unsafe, many features require secure contexts, and attackers can otherwise modify content in transit.
How do certificates fit into HTTPS?
During the TLS handshake, the server presents an X.509 certificate. The client checks that it chains to a trusted CA and matches the requested hostname.
What are essential HTTPS best practices?
Use TLS 1.2+, disable obsolete protocols, automate certificate renewal, enable HSTS, redirect HTTP to HTTPS, and monitor for mis-issuance and expiry.
References
Explore authoritative guidance and frameworks related to https.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.