HTTP & HTTPS

Whenever you open a website, your browser needs a way to communicate with the web server. It needs to request pages, send form data, download files, and receive other web resources.

This communication is handled mainly by HTTP and HTTPS.

HTTP (HyperText Transfer Protocol) is a protocol used for communication between web clients and web servers.

HTTPS (HyperText Transfer Protocol Secure) is HTTP carried over a secure, encrypted connection.

In simple terms:

HTTP → Web communication without transport encryption

HTTPS → Web communication protected using TLS encryption

How Does HTTP Work?

Suppose you enter:

https://example.com

into your browser.

Your browser acts as the client, while the website's server acts as the server.

The basic communication looks like:

Browser
   │
   │ HTTP Request
   ↓
Web Server
   │
   │ HTTP Response
   ↓
Browser

The browser sends a request, and the server sends back a response.

HTTP Request

An HTTP request is a message sent by a client to a web server.

A request can contain information such as:

• HTTP method

• Requested path

• Headers

• Optional request body

For example:

GET /index.html HTTP/1.1
Host: example.com

This essentially tells the server:

"Please give me /index.html."

HTTP Methods

HTTP provides different methods for performing different actions.

For example, when you open a webpage, your browser commonly sends a GET request.

When you submit a form, the application may use POST.

HTTP Response

After receiving a request, the server sends an HTTP response.

A response usually contains:

• Status code

• Headers

• Optional response body

For example:

HTTP/1.1 200 OK
Content-Type: text/html

The response body may contain HTML that the browser uses to display the webpage.

HTTP Status Codes

HTTP uses status codes to tell the client what happened.

You have probably seen 404 Not Found when trying to open a webpage that doesn't exist.

What Is HTTPS?

HTTPS stands for HyperText Transfer Protocol Secure.

HTTPS uses TLS (Transport Layer Security) to protect HTTP communication.

Instead of:

HTTP
 ↓
Network

HTTPS works roughly like:

HTTP
 ↓
TLS
 ↓
Network

TLS provides important security properties such as:

• Encryption – Helps prevent others from reading the protected traffic

• Integrity – Helps detect unauthorized modification of traffic

• Authentication – Helps the browser verify the server's identity using certificates

HTTP vs HTTPS

HTTPS is especially important when transmitting:

• Passwords

• Payment information

• Personal information

• Authentication cookies

• Private messages

How Does HTTPS Establish Security?

Before protected HTTP data is exchanged, the client and server perform a TLS handshake.

A simplified process looks like:

Browser
   │
   │ TLS Handshake
   ↓
Web Server
   │
   │ Certificate + Key Exchange
   ↓
Secure Connection
   │
   │ Encrypted HTTP
   ↓
Website

The actual TLS handshake is more detailed, but the basic idea is that both sides establish cryptographic parameters that allow them to communicate securely.

What Is an SSL Certificate?

You may hear people say SSL certificate, but modern HTTPS uses TLS, not the old SSL protocols.

A TLS certificate helps a browser verify the identity of a website.

For example, when you visit:

https://example.com

the browser can check whether the server's certificate is valid for that domain and whether it was issued by a trusted certificate authority.

Once the TLS connection is established, HTTP data can be transmitted securely.

HTTP/1.1, HTTP/2, and HTTP/3

HTTP has evolved over time.

HTTP/1.1

HTTP/1.1 is widely deployed and introduced persistent connections and other improvements over earlier HTTP versions.

HTTP/2

HTTP/2 improves web performance by supporting features such as:

• Multiplexing multiple requests and responses over one connection

• Header compression

• Binary framing

HTTP/3

HTTP/3 uses QUIC as its transport protocol instead of TCP.

QUIC itself runs over UDP and provides features such as reliable delivery, encryption, and stream multiplexing.

So the simplified relationship is:

HTTP/1.1 → Usually TCP + TLS
HTTP/2   → Usually TCP + TLS
HTTP/3   → QUIC over UDP

HTTP and HTTPS Ports

HTTP and HTTPS are commonly associated with these ports:

HTTP  → TCP 80
HTTPS → TCP 443

However, a web server can technically be configured to listen on different ports.

For HTTP/3, HTTPS traffic is carried using QUIC over UDP, commonly using port 443.

HTTP vs HTTPS Example

Suppose you submit your login information to a website.

With plain HTTP:

Browser ─── HTTP ───→ Server
          No TLS

The traffic is not protected by TLS.

With HTTPS:

Browser ═══ TLS ═══→ Server
        Encrypted
          HTTP

TLS helps protect the data while it is traveling between your browser and the server.

Does HTTPS Make a Website Completely Safe?

Not necessarily.

HTTPS protects communication in transit, but it does not automatically make the website itself trustworthy.

For example, a malicious website can also use HTTPS.

HTTPS mainly helps ensure:

• Your connection is encrypted

• Data is protected against modification in transit

• You are communicating with the domain represented by the valid certificate

It does not guarantee that the website's content or the organization behind it is trustworthy.

Conclusion

HTTP is a protocol used for communication between web clients and servers, while HTTPS is HTTP protected using TLS.

The basic difference is:

HTTP → Web communication without TLS encryption

HTTPS → HTTP + TLS security

Today, HTTPS is the standard for modern websites because it helps protect information such as passwords, cookies, personal data, and payment details while they travel across the network.

The easiest way to remember it is:

HTTP = Web communication

HTTPS = Web communication + Security