HTTPS
Definition
HTTPS is HTTP communication protected by TLS.
TLS protects the connection against eavesdropping and tampering on the transport path and usually authenticates the server via certificates. HTTPS does not automatically make the application itself secure.
Simply explained
Like a sealed and addressed transport channel for web data – the content can still be faulty.
Why it matters in practice
Basic requirement for modern websites, APIs, login, and form submission.
Example from business
A website permanently redirects HTTP to HTTPS and uses a valid certificate for domain and API.
Limits and pitfalls
- Equating HTTPS with complete web security; ignoring certificate errors; allowing mixed content; using outdated TLS configurations.
Origin & history
HTTP-over-TLS has been standardized through multiple RFCs. RFC 9110 currently defines the https URI semantics; TLS continues to evolve as a separate protocol.
Use in mid-sized companies
- Possible applications: secure website, API, and form transmission as well as a prerequisite for many browser features.
Frequently asked questions
Does HTTPS encrypt data on the server?
No, it primarily protects the transport. Does HTTPS prevent phishing? No.
Sources
- HTTP Semantics · RFC 9110, HTTP Semantics
- TLS 1.3 · RFC 8446, TLS 1.3
Sources checked on 10.10.2026.
Editorially reviewed on: