HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are application-layer protocols used to transfer web pages and other resources between web browsers and web servers.
The main difference is that HTTPS encrypts the communication, while HTTP does not.
| Feature | HTTP | HTTPS |
|---|---|---|
| Encryption | No | Yes |
| Default Port | 80 | 443 |
| Confidentiality | No | Yes |
| Integrity Protection | No | Yes |
| Authentication | No | Yes (certificate) |
| URL Prefix | http:// | https:// |
HTTP is the standard protocol used to transfer web pages.
Example:
http://example.com
With HTTP:
HTTPS is simply HTTP running over an encrypted TLS connection.
Example:
https://example.com
HTTPS provides three important security properties:
Suppose you log in to a website.
With HTTP:
Browser username password ────────────► Server
The information is not encrypted.
Someone monitoring the network may be able to read it.
With HTTPS:
Browser Encrypted Data ────────────► Server
Only the browser and server can read the information.
HTTPS relies on TLS (Transport Layer Security).
TLS is responsible for:
Without TLS, HTTPS would not exist.
Every HTTPS website presents a digital certificate.
The certificate contains information such as:
Your browser checks this certificate before establishing a secure connection.
Modern browsers typically show:
http://example.com
No padlock is displayed.
Some browsers may display:
Not Secure
https://example.com
A padlock icon indicates that the connection is encrypted.
Today, HTTPS should be used for nearly all websites, including:
Search engines also favor HTTPS-enabled websites.
No.
HTTPS only protects the communication between your browser and the server.
A malicious website can still use HTTPS.
Therefore:
HTTPS does not guarantee that a website is trustworthy.
It only guarantees that:
Telenegar Site Check can verify whether a website:
This information helps identify common security issues.