httphttps

HTTPHTTPS is not a formal protocol; it is a shorthand reference to the two related protocols that underpin the web: HTTP and HTTPS. HTTP, or Hypertext Transfer Protocol, is the foundational application layer protocol for fetching resources such as HTML documents, images, and stylesheets. It operates as a request–response model in which a client sends a request and a server returns a response. Data sent over HTTP is typically unencrypted, making it susceptible to eavesdropping and tampering. HTTP usually uses port 80 and is stateless, meaning each request is independent of others.

HTTPS, or HTTP Secure, is HTTP layered over Transport Layer Security (TLS) or formerly SSL. In HTTPS, the client and server perform a TLS handshake to establish a secure, authenticated channel before any HTTP data is exchanged. This channel provides confidentiality, integrity, and server authentication, with the server presenting a digital certificate issued by a trusted certificate authority. HTTPS commonly uses port 443 and is increasingly required for privacy and trust on the web.

Differences and practice: The primary difference is security; HTTPS protects data in transit. Performance concerns from encryption have largely been mitigated by improvements such as TLS optimizations and newer versions of the HTTP protocol (HTTP/2 and HTTP/3), which reduce latency and improve multiplexing. Web sites are encouraged to redirect HTTP to HTTPS and to implement security headers such as Strict-Transport-Security (HSTS). The use of TLS certificates from authorities like Let’s Encrypt has lowered the cost and complexity of deploying HTTPS.