HTTPS and Safe Connections

Introduction

Plain HTTP sends data as readable text. Anyone along the route, such as someone on the same public Wi-Fi, could read or change it. HTTPS fixes this.

The simple explanation

HTTPS is HTTP with encryption. It scrambles the conversation so only you and the server can read it.

Imagine sending a postcard versus a sealed, tamper-proof envelope. HTTP is the postcard. HTTPS is the sealed envelope.

What HTTPS gives you

Privacy: the data is encrypted, so others cannot read it.
Integrity: the data cannot be secretly changed on the way.
Authentication: you are talking to the real site, not an impostor, because the site proves its identity with a certificate.

HTTPS uses a protocol called TLS (Transport Layer Security).

Quick quiz

Which of these does HTTPS provide?

Certificates

A certificate is a digital ID for a website. It is issued by a trusted organisation called a certificate authority after checking the owner controls the domain. Your browser holds a list of authorities it trusts. If a certificate is wrong or expired, your browser warns you. Treat those warnings seriously.

How it starts

When you connect, your browser and the server do a quick handshake. They agree on how to encrypt, the server shows its certificate, and they create shared secret keys for the session. After that, everything is encrypted.

What the padlock does not mean

A padlock means the connection is encrypted and the domain matches. It does not mean the site is safe or honest. Scam and phishing sites can have valid certificates too. Always check the web address itself and be careful about what you enter.

For website owners

Use HTTPS on every page. Many hosts, including Netlify, provide free certificates and renew them automatically.

Try it yourself

Click the padlock icon next to a site's address in your browser and find the certificate details. Who issued it, and when does it expire?

Summary

HTTPS encrypts traffic and checks the site's identity using TLS and certificates.
A padlock shows a private connection, not a trustworthy website.
Always use HTTPS for sites you build.