Glossary · Internet & Web

HTTPS (HTTP Secure)

HTTPS is HTTP sent over a TLS-encrypted connection, protecting data from eavesdropping and tampering and verifying the site's identity with a certificate.

Updated October 6, 2026

HTTPS (HTTP Secure) is the standard HTTP protocol running inside an encrypted TLS connection. The browser verifies the server's certificate, then encrypts everything sent in both directions.

Why it matters

HTTPS protects passwords, forms and personal data on the network, prevents content injection by intermediaries and is expected by browsers, which flag plain HTTP pages as not secure. It requires a valid certificate that matches the domain and has not expired.

Free certificates from automated authorities have made HTTPS affordable for every site, so the main cost today is keeping renewals reliable.

Example

https://example.com shows a padlock when the certificate is valid. If the certificate expires, browsers show a full-page warning and most visitors leave, even though the server itself is still running.

Common mistakes

  • Letting the certificate expire because renewal was never automated.
  • Loading images or scripts over http:// on an HTTPS page, causing mixed content warnings.
  • Believing the padlock proves a site is trustworthy; it only proves the connection is encrypted.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Guide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readGuide · SSL & SecurityHTTP Security Headers Guide: HSTS, CSP, Referrer-Policy and MoreA practical guide to HSTS, CSP, X-Content-Type-Options, frame-ancestors, Referrer-Policy and Permissions-Policy, with nginx, Apache and Express examples.8 min readGuide · E-commerceShopify SSL Certificate Pending or Not Working: Causes and FixesWhy a Shopify domain shows SSL pending or a certificate warning, and a checklist of DNS, CAA, proxy and redirect problems to clear so the certificate issues.7 min readError fix · Browser errorsYour Connection Is Not Private Warning: Meaning and FixesTriage the "Your connection is not private" warning in Chrome, Edge and Safari: read the code under Advanced, find the cause, and know when not to proceed.4 min readGlossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecurityMan-in-the-Middle AttackA man-in-the-middle attack secretly intercepts or alters communication between two parties who believe they are talking directly to each other.

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.