🔒Hypertext Transfer Protocol Secure

NEW

HTTP layered over TLS to encrypt and authenticate web communications.

DESCRIPTION

HTTPS secures HTTP traffic using TLS, providing server authentication, confidentiality, and integrity. Certificates issued by trusted CAs validate server identity, while HSTS enforces secure connections. Modern deployments enable forward secrecy, strong ciphers, and ALPN for HTTP/2 and HTTP/3. Mutual TLS optionally authenticates clients. Correct configuration mitigates downgrade attacks, certificate misuse, and mixed-content vulnerabilities.

ALTERNATIVE DEFINITIONS

IETF RFC Editor

This memo describes how to use HTTP over TLS.

Defines the technical method for running HTTP over TLS.

Source

Wikipedia

HTTPS (Hypertext Transfer Protocol Secure) is an extension of HTTP. It is used for secure communication over a computer network and is widely used on the Internet.

Emphasizes secure communication and broad Internet usage.

Source

RELATED TERMS

TLS Secure Sockets Layer Certificate Authority HSTS Online Certificate Status Protocol HTTP-2 HTTP-3 Mutual TLS Public Key Infrastructure

COMPETING TERMS

Hypertext Transfer Protocol

KNOWLEDGE AREAS

Data Security Software Engineering Infrastructure

TARGET AUDIENCE

Security Architect Cybersecurity Engineer DevOps Engineer Software Developer Cloud Architect Chief Information Security Officer

EXTERNAL SOURCES

• Wikipedia - HTTPS
• IETF - HTTPS over TLS specification
• MDN Web Docs - Developer guide to HTTPS
• Let’s Encrypt - Free CA process overview

TOP QUESTIONS

Why is Hypertext Transfer Protocol Secure essential for modern websites?

HTTPS protects data privacy and integrity, authenticates servers, and is required by browsers for sensitive features. It builds user trust and improves SEO and performance.

Category: Relevancy

How do certificates enable trust in Hypertext Transfer Protocol Secure?

CAs issue certificates binding domain names to public keys. Browsers validate chains to trusted roots, ensuring the server is who it claims to be.

Category: Requirements

What is HSTS in Hypertext Transfer Protocol Secure?

HTTP Strict Transport Security (HSTS) instructs browsers to use HTTPS only, preventing downgrade and cookie hijacking via insecure connections.

Category: Definition

Which ciphers and protocols should be avoided in Hypertext Transfer Protocol Secure?

Disable outdated SSL versions, weak ciphers like RC4, and null/EXPORT suites. Prefer TLS 1.2+ with modern AEAD ciphers.

Category: Mistakes

How does Hypertext Transfer Protocol Secure interact with HTTP/2 and HTTP/3?

HTTPS commonly uses ALPN for negotiating HTTP/2/3 over TLS. These versions enhance performance while retaining TLS security guarantees.

Category: Topic

What is mutual TLS in Hypertext Transfer Protocol Secure?

mTLS authenticates clients with certificates, enabling strong identity assurance for APIs, B2B integrations, and zero-trust architectures.

Category: Definition

What are mixed-content risks under Hypertext Transfer Protocol Secure?

Loading non-HTTPS resources on HTTPS pages can compromise security. Browsers block or warn; ensure all assets are served securely.

Category: Risks

How do OCSP and certificate revocation affect Hypertext Transfer Protocol Secure?

OCSP checks certificate status, while stapling improves performance and privacy. Proper revocation handling mitigates misuse of compromised certificates.

Category: Management

What are alternatives or complements to Hypertext Transfer Protocol Secure for secure transport?

SSH tunnels and VPNs secure transport at different layers. HTTPS remains the default for web traffic and public APIs.

Category: Alternatives