HTTPS

Abbreviation · Security & Infosec

Definitions

  1. HTTPS (HyperText Transfer Protocol Secure) is the encrypted version of HTTP, the protocol used for transferring data between web browsers and servers. HTTPS wraps standard HTTP communication inside a TLS (Transport Layer Security) encrypted connection, preventing eavesdropping, tampering, and impersonation. When a browser connects to an HTTPS site, a TLS handshake occurs: the server presents its digital certificate (issued by a trusted Certificate Authority), the browser verifies its authenticity, and the two parties negotiate an encryption key for the session. All subsequent data, including URLs, headers, cookies, and body content, is encrypted. HTTPS has become the default for virtually all web traffic, driven by browser warnings for non-HTTPS sites, Google's ranking boost for HTTPS, and the availability of free certificates from Let's Encrypt. Beyond websites, HTTPS secures API calls, webhook deliveries, and any HTTP-based communication. Modern TLS 1.3 reduced handshake latency to a single round trip, largely eliminating the historical performance argument against HTTPS.

    In plain English: The secure version of HTTP that encrypts everything between your browser and the website, preventing anyone from eavesdropping on your passwords, messages, or data.

    Example: "Let's Encrypt made HTTPS free and automated — there's no excuse for plain HTTP anymore."

Etymology

1994
Netscape Communications created SSL (Secure Sockets Layer) and introduced HTTPS in Netscape Navigator 1.0, enabling encrypted communication between browsers and web servers.
1999
TLS 1.0 (RFC 2246) succeeded SSL 3.0 as the cryptographic protocol underlying HTTPS. The protocol provided authentication, confidentiality, and integrity for web traffic.
2014
Google announced that HTTPS would be a ranking signal in search results. The Heartbleed vulnerability in OpenSSL accelerated industry-wide adoption of better TLS practices.
2016-Present
Let's Encrypt launched free automated certificates, removing the cost barrier. Browser vendors began marking HTTP sites as 'Not Secure.' HTTPS usage surpassed 90% of web traffic.

Origin Story

Wrapping the Web in an Encrypted Envelope

HTTPS (HyperText Transfer Protocol Secure) is the encrypted version of HTTP, securing communication between a web browser and a server using TLS (Transport Layer Security, formerly SSL). The protocol was introduced by Netscape Communications in 1995, originally using their Secure Sockets Layer (SSL) protocol to protect credit card transactions on the early commercial web. For nearly two decades, HTTPS was used selectively, primarily on login pages and payment forms, because the computational overhead of encryption was considered too expensive for general use and SSL certificates cost money. The turning point came in the mid-2010s through a confluence of factors: Edward Snowden's 2013 revelations about mass surveillance made encryption a privacy imperative, Google announced in 2014 that HTTPS would be a ranking signal in search results, and Let's Encrypt launched in 2015 providing free, automated SSL certificates. The shift was dramatic. In 2014, roughly 30% of web traffic was encrypted; by 2023, that figure exceeded 95%. Modern browsers now display warnings for non-HTTPS sites, effectively making encryption the default rather than the exception. The original SSL protocol has been deprecated due to security vulnerabilities, replaced by TLS 1.2 and 1.3, but the term 'SSL' persists colloquially.

Coined by: Netscape Communications

Context: Introduced in 1995 by Netscape using their SSL protocol; became the web default after Let's Encrypt (2015) and browser enforcement.

Fun fact: Let's Encrypt, the nonprofit certificate authority that made HTTPS free, has issued over 4 billion certificates since its 2015 launch. It is funded by major tech companies including Google, Mozilla, and Meta, all of whom benefit from a more encrypted web.

Related Terms