HTTP vs HTTPS 🔒

HTTPS is just HTTP running over a TLS-encrypted connection. The protocol is the same; the channel underneath is secured.

What TLS adds

• Encryption — data is unreadable to anyone sniffing the wire.
• Integrity — tampering is detected; bytes can't be silently altered.
• Authentication — the server's certificate proves you're talking to the real site, not an impostor.

Without TLS, anyone on the network path (coffee-shop Wi-Fi, your ISP) can read or modify every request.

How a connection starts

Client                      Server
  | --- ClientHello ------->|
  | <-- ServerHello + cert -|
  |  (verify cert, agree key)
  | === encrypted HTTP ====>|

Client                      Server
  | --- ClientHello ------->|
  | <-- ServerHello + cert -|
  |  (verify cert, agree key)
  | === encrypted HTTP ====>|

After the handshake, the same GET / and headers you'd send over HTTP travel inside an encrypted tunnel on port 443 (vs 80 for plain HTTP).

Inspect a certificate

openssl s_client -connect example.com:443 -servername example.com

openssl s_client -connect example.com:443 -servername example.com

Look for the certificate chain and Verify return code: 0 (ok).

TL;DR: HTTPS = HTTP + TLS, adding encryption, integrity, and server authentication.

Audit your sites: every page should be HTTPS-only, no exceptions.