HTTPS (HTTP over TLS)

HTTPS is not a separate protocol: the browser opens a TLS connection to the server, verifies the certificate against the requested hostname, and then speaks ordinary HTTP inside that encrypted channel. The https:// URL scheme tells the client to do this, by default on port 443. HTTP/1.1 and HTTP/2 run HTTPS over TCP, while HTTP/3 uses QUIC, which builds TLS 1.3 into the transport.

Why it matters

Browsers mark plain HTTP pages as "Not secure", and many web features, such as service workers and geolocation, are available only in secure contexts; browsers also speak HTTP/2 only over TLS. HTTPS stops networks along the path from reading or injecting content, for example ads inserted by an intermediary. Two follow-ups complete a deployment: redirect all HTTP traffic to HTTPS and send an HSTS header so browsers never try plain HTTP again, and remove mixed content such as http:// scripts, which browsers block on HTTPS pages.

Example

A minimal nginx redirect from HTTP to HTTPS:

server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

Common misconceptions

• The padlock means the site is safe. It only means the connection is encrypted to whoever holds a certificate for that domain; phishing sites routinely use HTTPS.
• HTTPS hides the whole URL. Paths and query strings are encrypted, but the hostname is visible through DNS and SNI (unless ECH is used), and the server IP is always visible.
• HTTPS makes a site noticeably slower. With TLS 1.3, session resumption and HTTP/2 or HTTP/3, the overhead is usually negligible.