HTTPS is the secure version of HTTP, the protocol your browser uses to load websites. The "S" means the connection is encrypted with TLS (Transport Layer Security, the successor of SSL). Today almost every site uses it, and browsers warn you when one does not.
What HTTPS protects
- Confidentiality: nobody on the network, such as a public Wi-Fi operator or your ISP, can read the pages, passwords or forms you send.
- Integrity: nobody can change the page on the way, for example to inject ads or malware.
- Authentication: the certificate proves the server is allowed to use that domain name.
What the padlock does not prove
The padlock means "your connection to this domain is encrypted". It does not mean the site is honest. Phishing sites get free certificates too. Always check the domain name in the address bar: paypal.com.secure-login.example is not PayPal.
What HTTPS does not hide
| Hidden by HTTPS | Still visible to your ISP or network |
|---|---|
| The pages you open on the site | The site's IP address |
| Form data and passwords | Usually the domain name (through DNS and the TLS handshake) |
| Cookies and content | When and how much data you transfer |
To hide the domain names too, use encrypted DNS and a VPN.
How a TLS connection starts
- Your browser connects to the server and says which TLS versions it supports.
- The server sends its certificate, signed by a certificate authority (CA) your browser trusts.
- The browser checks the signature, the domain name and the expiry date.
- Both sides agree on encryption keys, and the page is sent encrypted.
This takes a few milliseconds with TLS 1.3.
Certificates
- Domain Validated (DV): proves control of the domain. Free from Let's Encrypt and most hosts. Used by most sites.
- Organization / Extended Validation (OV/EV): the CA also checks the company. Browsers no longer show this prominently.
Domain owners can restrict which CAs may issue certificates with a CAA record. Check it with our DNS Lookup.
Check a site's security headers
HTTPS is the start. Headers such as HSTS and Content-Security-Policy add more protection. See any site's headers and grade with the HTTP Headers Checker.
Certificate warnings
If your browser shows "Your connection is not private":
- The certificate may have expired, or not match the domain.
- On public Wi-Fi, a captive portal or an attacker may be intercepting the connection.
- Your computer's clock may be wrong.
Do not enter passwords on a page with a certificate warning.
Frequently asked questions
Is SSL the same as TLS?
TLS replaced SSL in 1999. People still say "SSL certificate", but every modern site uses TLS.
Does HTTPS make a site safe?
It makes the connection safe. The site's content and intentions are a separate question.
Does HTTPS affect search rankings?
Google uses HTTPS as a small ranking signal, and Chrome marks HTTP sites as "Not secure".