What is HTTPS, and why every site needs it

HTTPS is the secure version of HTTP, the protocol your browser uses to fetch web pages. The "S" stands for secure: HTTPS is simply HTTP carried inside an encrypted, authenticated TLS connection.

Most large websites switched years ago, but many smaller sites, including plenty of institute websites, still have gaps: a login page on HTTPS but a homepage on HTTP, an expired certificate, or images loaded insecurely. Here's why that matters even for a simple site, and how to get it right.

HTTP vs HTTPS in one picture

Plain HTTP is like sending a postcard. Every sorting office and postal worker that handles it can read it, and in principle change it, before it reaches the recipient.

HTTPS is a sealed, tamper-evident envelope, addressed to a recipient whose identity has been checked. The people carrying it can see where it's going but not what's inside, and any attempt to open it shows.

On the internet, the "postal workers" include whoever runs the Wi-Fi you're on, whether that's in a PG hostel, a café, a coaching centre or a self-study library, as well as internet providers and any compromised equipment along the route. HTTPS protects data in transit only; our guide to encryption at rest vs in transit explains what covers the rest.

What can go wrong on plain HTTP

• Eavesdropping. Whatever visitors type into a form, from names and phone numbers to passwords, travels in readable form.
  
  
• Tampering. Anyone on the path can modify a page before it reaches the visitor: inject ads or malicious scripts, change a contact number, or in principle swap a fee-payment QR code for their own.
  
  
• Impersonation. Without a certificate, visitors have no proof they're on the real site rather than a look-alike served on the same network.
  
  
• Session theft. Login cookies sent over HTTP can be captured and reused to take over an account.
  
  

"But my site doesn't collect anything sensitive"

This is the most common reason given for skipping HTTPS, and it no longer holds up.

Browsers warn visitors away

Chrome has labelled HTTP pages "Not secure" since 2018. Google has also announced that from Chrome 154, expected in October 2026, the "Always Use Secure Connections" setting will be on by default for everyone: Chrome will try HTTPS first and warn before loading public sites that only offer HTTP. A parent looking up your institute shouldn't meet a warning before they meet your homepage.

Modern features require it

Browsers reserve powerful features for secure pages. Without HTTPS, you can't use:

• camera and microphone access, which interactive live classes and proctored tests depend on;
  
  
• push notifications and offline support through service workers;
  
  
• passkeys and other modern sign-in methods;
  
  
• DRM-protected video playback, which Chrome allows only on secure pages;
  
  
• HTTP/2 and HTTP/3, the faster versions of the web's protocol, which browsers only use over encrypted connections.
  
  

Search engines prefer it

Google has used HTTPS as a ranking signal since 2014. It's a small factor on its own, but there's no reason to give it away.

Your content stays yours

Even a simple brochure site deserves to reach visitors exactly as you published it, without injected ads or altered phone numbers.

How HTTPS works, briefly

1. The browser connects to your server and starts a TLS handshake.
   
   
2. The server presents its certificate, proving it controls your domain.
   
   
3. Browser and server agree on fresh encryption keys for this visit.
   
   
4. Every request and response, including pages, images, form data and cookies, travels encrypted and tamper-proof.
   
   

Our guide to how SSL/TLS works covers each step in detail.

"Won't HTTPS slow my site down?"

Not in any way visitors will notice. Encryption costs very little on modern hardware, TLS 1.3 needs only one round trip to set up a connection, and returning visitors can resume an earlier session. HTTPS also unlocks HTTP/2 and HTTP/3, which load many files over a single connection, so an HTTPS site is usually faster than the same site on old-style HTTP.

Setting up HTTPS properly: a checklist

1. Get a certificate and automate renewal. Free certificates are available from Let's Encrypt, and most hosting providers and CDNs include them. Since March 2026, public certificates can be valid for at most 200 days, falling to 47 days by 2029, so renewal has to be automatic. Our explainer on certificates and PKI covers who issues them.
   
   
2. Redirect all HTTP traffic to HTTPS with a permanent (301) redirect.
   
   
3. Fix mixed content. Make sure images, scripts, fonts, embedded videos and form submissions all use HTTPS. Browsers block or flag insecure pieces on secure pages.
   
   
4. Turn on HSTS. The Strict-Transport-Security header tells browsers to use HTTPS for your domain on every future visit, even if someone types or clicks an http:// link. Start with a short duration, and include subdomains only once every one of them supports HTTPS. Joining the browser preload list is hard to undo.
   
   
5. Cover every subdomain. www, app, admin, payments, the student portal: check them all, not just the homepage.
   
   
6. Use modern protocol settings. Enable TLS 1.3, keep TLS 1.2 for compatibility, and disable TLS 1.0 and 1.1. See TLS 1.2 vs TLS 1.3 for the differences.
   
   
7. Secure your cookies with the Secure and HttpOnly flags, so they are never sent over plain HTTP or exposed to page scripts.
   
   
8. Monitor. Set alerts for certificate expiry, and test your configuration regularly with a free TLS checker.
   
   

What the lock icon does and doesn't mean

For years, browsers showed a padlock on HTTPS sites, and many people read it as "this site is safe". It never meant that. It means the connection is encrypted and that you are talking to the domain in the address bar, whoever runs it. Phishing sites routinely use HTTPS. Partly for that reason, Chrome replaced its padlock with a neutral "tune" icon in 2023. Encourage staff and students to check the domain name itself, especially on payment pages.

Key takeaways

• HTTPS is HTTP inside an encrypted, authenticated TLS connection.
  
  
• Plain HTTP exposes visitors to eavesdropping, tampering and impersonation on any network they use.
  
  
• Browsers increasingly warn about HTTP, and features such as camera access, notifications and DRM playback require HTTPS.
  
  
• HTTPS is free, fast and largely automated, but it needs correct setup: redirects, HSTS, no mixed content and automatic renewal.
  
  
• HTTPS proves who you're connected to, not whether they deserve your trust.
  
  

HTTPS has gone from a nice-to-have for login pages to the baseline for every page on the web. For an institute, it protects students and parents, keeps your content exactly as you wrote it, and makes the modern tools of online teaching possible. If any part of your site still loads over plain HTTP, fixing it is one of the cheapest security upgrades available to you.

Frequently asked questions

What is the difference between HTTP and HTTPS?

HTTPS is HTTP sent inside an encrypted, authenticated TLS connection. With plain HTTP, anyone on the network path, such as a Wi-Fi operator, can read and change pages and form data. With HTTPS, the content is encrypted, any tampering is detected, and the browser checks a certificate proving it is talking to the real domain. The web addresses begin with https:// instead of http://.

Is HTTPS free?

The certificate can be. Let's Encrypt issues free, trusted certificates, and most hosting providers and CDNs include HTTPS at no extra cost. What takes effort is setting it up properly: redirecting all HTTP traffic, fixing mixed content, turning on HSTS, securing cookies and automating renewal, since public certificates now last at most 200 days.

Does HTTPS mean a website is safe?

No. HTTPS means your connection to the site is private and that you are talking to the domain in the address bar. It says nothing about whether the people running that domain are honest, and phishing sites routinely use HTTPS. Always check the domain name itself, especially before paying fees or entering a password.

Does HTTPS help with Google rankings?

A little. Google has used HTTPS as a ranking signal since 2014, though it is a small factor on its own. The bigger effects are indirect: browsers warn visitors away from plain HTTP pages, and HTTPS unlocks HTTP/2 and HTTP/3, which usually make a site load faster.