What does HTTPS mean?#
The S at the end stands for Secure. With HTTPS, the usual conversation between browser and server still takes place, but first the two sides agree on an encryption key, and then everything is encrypted. If someone spies on public Wi-Fi at a cafe or airport, all they see is scrambled characters.
Three things HTTPS does#
- Encryption: passwords and card details cannot be read in transit.
- Authentication: the SSL certificate proves you are really talking to the site you think you are.
- Tamper protection: content cannot be changed on the way, for example an unwanted ad cannot be injected into the page.
Its sign in the browser#
The address begins with https and a padlock icon appears beside it. If the browser shows a "not secure" warning, you should not enter sensitive information.
Common mistake#
The HTTPS padlock means the connection is encrypted, not that the site itself is trustworthy. Phishing sites can get certificates too. So always look at the domain name carefully.
For site owners#
An SSL certificate can usually be enabled from your host for free or at low cost. Google also uses HTTPS as a positive signal, and without it browsers flag a site's forms as "not secure". So today enabling it is practically mandatory.