# What Is HTTPS (HTTP over TLS)? Definition and Examples

> HTTPS is HTTP carried over a TLS connection, normally on port 443, so page content, cookies and form data are encrypted and the server is authenticated.

Source: https://ssl.sh/glossary/https/
Last updated: 2026-11-10

HTTPS is not a separate protocol: the browser opens a [TLS](https://ssl.sh/glossary/tls/) connection to the server, verifies the certificate against the requested hostname, and then speaks ordinary HTTP inside that encrypted channel. The `https://` URL scheme tells the client to do this, by default on port 443. HTTP/1.1 and HTTP/2 run HTTPS over TCP, while HTTP/3 uses QUIC, which builds TLS 1.3 into the transport.

## Why it matters
Browsers mark plain HTTP pages as "Not secure", and many web features, such as service workers and geolocation, are available only in secure contexts; browsers also speak HTTP/2 only over TLS. HTTPS stops networks along the path from reading or injecting content, for example ads inserted by an intermediary. Two follow-ups complete a deployment: redirect all HTTP traffic to HTTPS and send an [HSTS](https://ssl.sh/glossary/hsts/) header so browsers never try plain HTTP again, and remove [mixed content](https://ssl.sh/glossary/mixed-content/) such as `http://` scripts, which browsers block on HTTPS pages.

## Example
A minimal nginx redirect from HTTP to HTTPS:

```nginx
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}
```

## Common misconceptions
- **The padlock means the site is safe.** It only means the connection is encrypted to whoever holds a certificate for that domain; phishing sites routinely use HTTPS.
- **HTTPS hides the whole URL.** Paths and query strings are encrypted, but the hostname is visible through DNS and SNI (unless ECH is used), and the server IP is always visible.
- **HTTPS makes a site noticeably slower.** With TLS 1.3, session resumption and HTTP/2 or HTTP/3, the overhead is usually negligible.

## Related terms

- [TLS](https://ssl.sh/zh/glossary/tls/): TLS 是 IETF 制定的传输层安全协议，为 HTTPS 等网络连接提供加密、完整性保护和服务器身份认证，是 SSL 的继任者。
- [SSL 证书](https://ssl.sh/zh/glossary/ssl-certificate/): SSL 证书是由 CA 签名的 X.509 证书，把公钥与一个或多个域名（或 IP 地址）绑定，供 TLS 客户端验证服务器身份。
- [HSTS](https://ssl.sh/zh/glossary/hsts/): HSTS 是一个 HTTP 响应头，告诉浏览器在指定时间内只通过 HTTPS 访问该站点，并且遇到证书错误时不允许用户继续访问。
- [混合内容](https://ssl.sh/zh/glossary/mixed-content/): 混合内容是指通过 HTTPS 加载的页面中，部分脚本、图片、iframe 等子资源仍通过明文 HTTP 加载，削弱了整个页面的安全性。
- [SNI](https://ssl.sh/zh/glossary/sni/): SNI 是 TLS 的一个扩展，客户端在 ClientHello 中写明要访问的域名，使同一个 IP 能为多个 HTTPS 站点分别返回各自的证书。
- [SSL 剥离](https://ssl.sh/zh/glossary/ssl-stripping/): SSL 剥离是一种中间人攻击，攻击者截获本应把用户引向 HTTPS 的跳转或链接，让用户一直停留在明文 HTTP 上。