HTTP vs HTTPS - What's the Difference?
HTTP (HyperText Transfer Protocol) and HTTPS (HTTP Secure) are both protocols for transferring data between your browser and web servers. The critical difference is that HTTPS wraps the connection in TLS encryption, making it impossible for anyone on the network path - Your ISP, a public Wi-Fi operator, or a man-in-the-middle attacker - To read or modify the data in transit.
HTTP vs HTTPS Side-by-Side
| Property | HTTP | HTTPS |
|---|---|---|
| Default port | 80 | 443 |
| Encryption | None - Plaintext | TLS 1.2 or 1.3 |
| Data integrity | No - Content can be injected by intermediaries | Yes - AEAD ciphers detect any tampering |
| Authentication | No - No proof server is who it claims | Yes - TLS certificate validates server identity |
| SEO impact | Penalised by Google since 2014 | Ranking signal; required for some features |
| Browser treatment | "Not Secure" warning in Chrome, Firefox, Edge | Padlock icon (secure) |
| Performance | Slightly faster (no handshake) | Negligible overhead with TLS 1.3 (0-RTT resumption) |
The TLS Handshake
When your browser connects to an HTTPS site, a TLS handshake occurs before any HTTP data is exchanged. In TLS 1.3 the handshake takes one round trip (1-RTT): the client sends supported cipher suites and key share; the server responds with its chosen cipher, certificate, and key share; encrypted application data begins immediately. The symmetric session key is derived using the Diffie-Hellman key exchange - Meaning even if the server's private key is later compromised, past sessions remain secure (Forward Secrecy).
Mixed Content and When to Trust HTTPS
- Mixed content: an HTTPS page that loads HTTP subresources (images, scripts, iframes) undermines security - Modern browsers block active mixed content (scripts, iframes) automatically.
- HTTPS confirms the connection is encrypted and the certificate is valid - It does not guarantee the site is trustworthy or not a phishing site. Use the SSL checker to inspect a site's certificate.
- HTTP Strict Transport Security (HSTS) headers tell browsers to always connect via HTTPS and refuse to connect over HTTP for the specified max-age period.
- HTTP/3 (QUIC) uses UDP instead of TCP and always requires TLS 1.3 - There is no HTTP/3 over unencrypted connections.
- If you see your browser's "Not Secure" warning on a login or payment page, do not enter any sensitive data.