Definition
HTTPS is HTTP layered over an SSL/TLS encrypted connection, shown in browsers as a padlock icon next to a URL that starts with https://, so data moving between a browser and a server cannot be read or altered in transit. The connection begins with a TLS handshake: the browser checks the server's certificate against a trusted certificate authority, negotiates a cipher suite, and derives session keys, typically in under 100 milliseconds. From that point every request, response, cookie, form submission and credential is encrypted. HTTPS is now a prerequisite rather than an option: browsers block or restrict service workers, payment APIs, geolocation and HTTP/2/HTTP/3 on plain HTTP, Chrome and Firefox mark HTTP pages "Not Secure," and Google has used HTTPS as a ranking signal since 2014. Free automated certificates from Let's Encrypt, issued in seconds and renewed automatically, removed cost and complexity as excuses, so nearly all production traffic on the web is now HTTPS by default.
How it works
When a browser connects to an HTTPS site, the two ends perform a TLS handshake: they verify the server's certificate, agree on encryption keys, and switch the connection to encrypted mode. From then on every request and response is encrypted in transit.
Why it matters
HTTPS protects users from network attackers, unlocks modern browser features that HTTP-only sites cannot use, satisfies a Google ranking signal, and removes the "Not Secure" warning that drives visitors away. In 2026 there is no production scenario where HTTP-only is acceptable.