HTTPS

HTTPS, or Hypertext Transfer Protocol Secure, is the extension of HTTP that uses TLS (Transport Layer Security) to encrypt data in transit between a client and a server. It provides confidentiality, integrity, and server authentication. By default, it operates over TCP port 443 and requires a digital certificate issued by a trusted certificate authority to authenticate the server to the client.

When a connection is established, a TLS handshake negotiates the protocol version and cipher suite, establishes a session key, and then HTTP messages are exchanged inside TLS records. The client validates the server certificate against a trusted store; if validation fails, the connection is aborted. TLS supports features such as forward secrecy and various cipher suites, with TLS 1.3 widely adopted for improved security and performance.

HTTPS offers strong security benefits but is not a guarantee of safety. It protects data from eavesdropping and tampering in transit and helps verify the server’s identity, but it cannot protect endpoints themselves. Security depends on proper certificate issuance and management; misissued or compromised certificates, failures in the trust model, or user-focused phishing can undermine protections. Mixed content and misconfigured servers can also weaken security.

Adoption and best practices emphasize using TLS 1.2 or higher, preferably TLS 1.3; obtaining valid certificates from reputable authorities; enabling security features such as HTTP Strict Transport Security (HSTS) and certificate transparency; avoiding mixed content; and monitoring certificate lifetimes and renewals. HTTPS is the standard method for securing web traffic and is commonly used for sensitive sites including e-commerce and login interfaces.