====== HTTP vs HTTPS ======

HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are application-layer protocols used to transfer web pages and other resources between web browsers and web servers.

The main difference is that **HTTPS encrypts the communication**, while HTTP does not.

-----

===== At a Glance =====

^ Feature ^ HTTP ^ HTTPS ^
| Encryption | No | Yes |
| Default Port | 80 | 443 |
| Confidentiality | No | Yes |
| Integrity Protection | No | Yes |
| Authentication | No | Yes (certificate) |
| URL Prefix | http:// | https:// |

-----

===== What Is HTTP? =====

HTTP is the standard protocol used to transfer web pages.

Example:

<code>
http://example.com
</code>

With HTTP:

  * Data is transmitted in plain text.
  * Anyone who intercepts the traffic may be able to read it.
  * The browser cannot verify the identity of the website.

-----

===== What Is HTTPS? =====

HTTPS is simply HTTP running over an encrypted TLS connection.

Example:

<code>
https://example.com
</code>

HTTPS provides three important security properties:

  * Encryption
  * Authentication
  * Data Integrity

-----

===== Why Is HTTPS Important? =====

Suppose you log in to a website.

With HTTP:

<code>
Browser

username
password

────────────►

Server
</code>

The information is not encrypted.

Someone monitoring the network may be able to read it.

With HTTPS:

<code>
Browser

Encrypted Data

────────────►

Server
</code>

Only the browser and server can read the information.

-----

===== TLS =====

HTTPS relies on **TLS (Transport Layer Security)**.

TLS is responsible for:

  * Encrypting data
  * Verifying the server's identity
  * Protecting data from modification

Without TLS, HTTPS would not exist.

-----

===== Certificates =====

Every HTTPS website presents a **digital certificate**.

The certificate contains information such as:

  * Domain name
  * Organization (when applicable)
  * Certificate Authority (CA)
  * Expiration date
  * Public key

Your browser checks this certificate before establishing a secure connection.

-----

===== Browser Indicators =====

Modern browsers typically show:

===== HTTP =====

<code>
http://example.com
</code>

No padlock is displayed.

Some browsers may display:

<code>
Not Secure
</code>

-----

===== HTTPS =====

<code>
https://example.com
</code>

A padlock icon indicates that the connection is encrypted.

-----

===== Common Uses =====

Today, HTTPS should be used for nearly all websites, including:

  * Online banking
  * Email
  * E-commerce
  * Social media
  * Government services
  * Personal blogs

Search engines also favor HTTPS-enabled websites.

-----

===== Can HTTPS Guarantee a Safe Website? =====

No.

HTTPS only protects the communication between your browser and the server.

A malicious website can still use HTTPS.

Therefore:

HTTPS **does not guarantee that a website is trustworthy**.

It only guarantees that:

  * The connection is encrypted.
  * The server has presented a valid certificate.

-----

===== HTTP vs HTTPS in Telenegar =====

Telenegar Site Check can verify whether a website:

  * Supports HTTPS
  * Redirects HTTP to HTTPS
  * Has a valid TLS certificate
  * Uses modern TLS versions
  * Has certificate problems

This information helps identify common security issues.

-----

===== Common Misconceptions =====

  * **HTTPS means the website is safe.**
    * False. HTTPS secures the connection, not the website's content.

  * **HTTP is obsolete.**
    * False. HTTP is still used in some internal networks and legacy systems, although HTTPS is strongly recommended for public websites.

  * **HTTPS is much slower than HTTP.**
    * Modern TLS implementations have very little performance impact on today's hardware and networks.

-----

===== Related Topics =====

  * [[security:tls-ssl|TLS / SSL]]
  * [[security:security-headers|Security Headers]]
  * [[tools:sitecheck|Site Check]]
  * [[networking:protocols:tcp-udp|TCP vs UDP]]

-----

{{tag>http https tls ssl web security protocols}}