Glossary · Beginner
HTTPS connection
HTTPS is HTTP carried through an authenticated encrypted connection, giving a web origin transport confidentiality and integrity.
- Published
- Last checked
Definition
HTTPS identifies an HTTP origin reached through a secured connection, normally TLS. It authenticates the server for the requested name and protects traffic against ordinary network reading or modification in transit. The scheme and port are part of origin identity.
What it protects
HTTPS protects transport between the user agent and the server endpoint. It does not prove that the site's claims are true, its code is safe, its database is secure, or its third parties respect privacy. A valid certificate is one necessary boundary, not a general trust badge.
Deployment consequences
Public sites should redirect HTTP to the canonical HTTPS URL without chains and avoid mixed active content. Cookies carrying authority need secure attributes, and production links, canonicals, sitemaps, callbacks, and webhooks should agree on the HTTPS origin. HSTS can tell browsers to prefer HTTPS after policy is established carefully.
Review question
Does every public route reach one HTTPS canonical in a single predictable path? Inspect the certificate name and validity, redirect chain, mixed-content console, security headers, cookie flags, and external callbacks. Test a deliberately wrong hostname and plain HTTP request. Encryption should fail closed rather than silently delivering a different or partially secure experience.
HTTPS does not validate the truth of page content or the safety of code running after delivery. Continue to review scripts, permissions, data collection, authentication, and server authorization. Transport protection is one boundary in a larger security model.