HTTP and HTTPS: what changes when a site is secure

HTTP is the protocol browsers use to request and receive web resources. HTTPS is HTTP carried through a TLS-encrypted connection. TLS helps prevent people on the network from reading or changing data in transit, and the certificate helps the browser verify that it is talking to the intended domain.

How it works

The padlock does not mean a website is honest or that every page is safe. It means the connection to that domain is encrypted and the certificate check passed. A phishing site can also use HTTPS. The domain name, spelling and context still matter.

Practical takeaways

Avoid entering sensitive data on a page that shows certificate errors. Check the address bar carefully, keep the browser updated and use unique passwords with multi-factor authentication. Site owners should redirect HTTP to HTTPS and keep certificates renewed.

HTTPS protects traffic in transit; it does not protect a compromised device, a malicious account or data after the server receives it.

In short: HTTPS is a baseline for the modern web: encryption in transit plus domain verification, but not a guarantee of trustworthiness.