HTTPS (Hypertext Transfer Protocol Secure) is how a browser and website exchange pages when the connection is encrypted. The address starts with https://, and the browser shows a lock or tune icon instead of a "Not secure" label. It means the café Wi-Fi owner, the internet provider or anyone else on the path cannot read the page or quietly change it.
What the S adds to HTTP
Plain HTTP sends requests and pages as readable text. HTTPS sends exactly the same HTTP messages, but wrapped inside a TLS connection. Before the first request, the server proves its identity with an SSL certificate and the two sides agree on encryption keys. It normally runs on port 443, while HTTP uses port 80.
HTTPS hides the page content, form data, cookies and the full path of the URL. It does not hide which domain you are visiting, and it says nothing about whether the business behind the site is honest. Phishing sites get certificates too.
Moving a site from HTTP to HTTPS
Picture a plumbing company whose old site still answers at http://. The switch looks like this: install a certificate, make every internal link and image use https, then add a permanent 301 redirect from each http address to its https twin so bookmarks and Google's index follow. Finally, update the property in Google Search Console and the site URL in any ads or listings. Once it is stable, adding an HSTS header tells browsers to always use HTTPS for that domain.
Why it matters even for a simple site
Chrome, Safari and Firefox label HTTP pages as not secure, which puts people off filling in a contact form. Google confirmed HTTPS as a lightweight ranking signal in 2014. Many browser features, including geolocation, service workers and camera access, only work on secure pages. There is no longer a cost reason to skip it, since free certificates are standard.
Where HTTPS setups go wrong
- Mixed content: the page loads over HTTPS but a script, font or image still comes from an http:// URL, so the browser blocks it or removes the lock.
- Both versions live: http and https copies of each page serve content with no redirect, splitting links and confusing search engines.
- Redirect chains: http to https to www to a trailing slash adds several hops; send old URLs straight to the final address.
- Hard-coded http links in emails, QR codes or printed menus that never get updated.
Related terms
- TLS: the encryption layer underneath HTTPS.
- SSL certificate: needed before a server can speak HTTPS.
- 301 redirect: how old http addresses are sent to https.
- URL: where the https prefix appears.