Topic
HTTPS
HTTPS is HTTP carried over a secure transport so a browser and server can protect traffic against passive reading and detect tampering in transit.
At a glance
- Underlying web protocol
- HTTP
- Security layer
- TLS
Overview
HTTPS combines HTTP with transport security, most commonly TLS. The browser authenticates the server certificate for the hostname and establishes encrypted communication before ordinary HTTP messages are exchanged. This protects the connection in transit, but it does not by itself prove that the content is trustworthy, that the site owner is honest, or that a downloaded file is safe.
What the secure connection provides
A correctly configured HTTPS connection protects the confidentiality and integrity of traffic between the endpoints and authenticates the server identity represented by its certificate. That prevents many forms of network eavesdropping and modification while the traffic is crossing untrusted networks.
What HTTPS does not guarantee
The lock or secure-connection indicator says something about the connection, not the truthfulness of the page. Phishing sites and malicious services can also use valid HTTPS, so users still need to evaluate the destination, requested actions, and content itself.
Sources and review
MOOR's explanatory text is supported by the following source links.
- HTTPS glossary — MDN Web Docs
- The Transport Layer Security (TLS) Protocol Version 1.3 — RFC Editor