HTTPS
HTTPS, or HyperText Transfer Protocol Secure, is HTTP transmitted over an encrypted TLS connection.
It protects communication between a browser and a website while the information is travelling across the network.
MDN defines HTTPS as the encrypted version of HTTP using TLS to secure communication between a client and server. MDN's HTTPS glossary
What HTTPS Provides
TLS-secured communication provides three important properties:
### Encryption
Someone observing the network should not be able to simply read the transmitted content.
### Integrity
An attacker should not be able to silently alter the transmitted information without detection.
### Authentication
The browser can verify that the server is presenting valid identity credentials for the requested hostname.
MDN's TLS security documentation explains these three properties in more detail. MDN's Transport Layer Security guide
HTTPS vs. TLS Certificate
The TLS Certificate supports authentication during the secure connection.
HTTPS describes the web communication occurring over TLS.
They are closely related but not identical concepts.
HTTPS vs. DNSSEC
HTTPS protects the browser-to-server connection.
DNSSEC authenticates DNS information.
One does not replace the other.
Redirecting HTTP to HTTPS
A site should normally serve its pages over HTTPS.
Requests to an old HTTP address can be redirected to the corresponding HTTPS version using an HTTP Redirect.
MDN recommends serving website resources over HTTPS and describes permanent HTTP-to-HTTPS redirection as part of secure TLS configuration. MDN's TLS configuration guidance
Mixed Content
A page delivered over HTTPS should also load its important resources securely.
If an HTTPS page requests scripts, images, fonts, or other resources over insecure HTTP, browsers may treat that as mixed content and block or warn about it.
HTTPS and SEO
HTTPS is part of the normal technical foundation of a modern website, but installing a certificate should not be treated as a complete Technical SEO strategy.
When moving an older website from HTTP to HTTPS, URL consistency, Redirects, Canonical URLs, and internal links should also be reviewed.
Common Problems
Common problems include:
- HTTP version remains independently accessible
- Redirect chains between HTTP,
www, and canonical hostname - Certificate missing for a subdomain
- Mixed-content resources
- Old hardcoded HTTP links
- CDN and origin using incompatible TLS configuration
How to Improve
Serve the complete site securely.
Use:
- Valid automatically renewed TLS certificates
- HTTPS URLs internally
- Direct HTTP-to-HTTPS redirects
- Secure third-party resources
- Consistent canonical hostnames
Then test the full production environment rather than only the homepage.