What is HTTPS? It is the secure version of the protocol your browser uses to load websites. HTTPS encrypts the connection between your browser and the site, so people on the same network cannot easily read or alter what passes between you. It confirms you are talking to the right server, but it does not prove the site itself is honest.
What is HTTPS compared with HTTP?
The web was built on HTTP, which sends data as plain text. Anyone along the route, whether on the same Wi-Fi, at the internet provider or operating a router in between, could read or modify it. The S in HTTPS stands for secure. It means the same web traffic is wrapped in an encrypted layer called TLS (Transport Layer Security), the successor to the older SSL name you may still see mentioned.
Today most major sites use HTTPS by default, and browsers actively warn you when a page does not.
What HTTPS actually protects
A properly working HTTPS connection gives you three things:
- Privacy. The content of the page, form entries such as passwords and the data you send are encrypted in transit.
- Integrity. The data cannot be quietly changed on the way. This stops a hostile network from injecting adverts or malicious code into a page you load.
- Authentication. Your browser checks that the server presenting itself as a given domain really holds a valid certificate for it.
This is why HTTPS is a big part of staying safe on public Wi-Fi. Even if you share a network with strangers, they cannot read your encrypted page content.
How it works, briefly
When you visit an HTTPS site, your browser and the server perform a short handshake. The server presents a digital certificate, issued by a certificate authority your device already trusts, which ties the domain name to a cryptographic key. The browser checks that the certificate is valid, current and matches the site. The two sides then agree on temporary keys and use them to encrypt everything that follows.
You never see any of this. It takes a moment and then runs in the background for the whole visit.
What HTTPS does not tell you
Here is the important caveat. A padlock means the connection is encrypted and the domain matches the certificate. It does not mean the site is trustworthy. Criminals can and do obtain certificates for their own fake domains, so a phishing page can carry a padlock just as easily as a real shop.
HTTPS also does not hide everything. The domain you visit is often still visible to the network, for example through DNS lookups, as we describe in DNS explained for beginners. The site you are connecting to still sees your IP address, and anything you willingly give it, it keeps. Encryption protects data in transit, not what a site does with it afterwards.
How to check a page is secure
Read the address, not just the icon
Look at the domain in the address bar. Check the spelling carefully, since lookalike names with swapped letters are a classic trick. The part just before the first single slash is the real domain, so something like a trusted name followed by extra words and a different ending is not the trusted site.
Look for the secure indicator
Browsers show a padlock or similar symbol, and wording differs between them. You can click it to see connection details and certificate information. If a page is not secure, the browser will usually say so near the address.
Take warnings seriously
A full-page warning about an invalid or expired certificate is not decoration. It can mean misconfiguration, but it can also mean someone is interfering with the connection. If it appears on a bank, email or shopping site, do not click through.
A quick comparison
| HTTP | HTTPS | |
|---|---|---|
| Traffic encrypted | No | Yes |
| Detects tampering | No | Yes |
| Checks server identity | No | Yes, via certificate |
| Guarantees an honest site | No | No |
Practical habits
- Never enter passwords or payment details on a page marked not secure.
- Type or bookmark the addresses of important sites rather than following links in unexpected messages.
- Keep your browser updated, because it carries the list of trusted certificate authorities and the latest security fixes.
- Use a password manager. Many will refuse to fill in a login on a domain that does not match the saved one, which is a handy warning against fakes.
- Remember that HTTPS covers browsing. Other kinds of traffic may use different protection, and a VPN adds a layer around all of it.
Some browsers offer an HTTPS-only mode that tries the secure version first and warns before loading an unsecured page. It is worth switching on if yours has it.
Where to start
Make a habit of glancing at the address bar before logging in, enable HTTPS-only mode if your browser offers it and treat certificate warnings as stop signs. HTTPS is one layer among several, so pair it with updates and good passwords. If you want to go further on how data travels safely across shared and home networks, browse our Wi-Fi and networking guides.
Frequently asked questions
Is HTTPS the same as a VPN?
No. HTTPS protects the connection between your browser and one website, while a VPN encrypts traffic from your device to the VPN server for all your apps.
If a site has a padlock, is it safe to trust?
Not automatically. The padlock means the connection is encrypted, but fake and phishing sites can have one too, so check the domain name carefully.
What is the difference between SSL and TLS?
TLS is the modern successor to SSL. People still say SSL out of habit, but current secure connections use TLS.
Can my internet provider see what I do on HTTPS sites?
It cannot read page content, but it can often see which domains you connect to. A VPN can hide that from your provider.
