HTTPS is the encrypted version of HTTP, protecting data sent between a browser and a web server.
HTTPS stands for Hypertext Transfer Protocol Secure. It's how browsers and websites talk to each other privately. When a site uses HTTPS, everything sent between the visitor and the server, from passwords to card details to the pages themselves, is encrypted so nobody in between can read or change it.
You can tell a site uses HTTPS because its address starts with https:// and the browser shows a padlock or similar icon. Sites still on plain HTTP are marked "Not secure" in Chrome and other browsers.
How HTTPS works
HTTPS is ordinary HTTP running inside an encrypted connection made with TLS (Transport Layer Security, the successor to SSL). When you visit a site:
- The browser connects and asks for the site's SSL certificate.
- It checks the certificate was issued by a trusted authority and matches the domain.
- Browser and server agree on encryption keys, a step called the TLS handshake.
- All further data travels encrypted.
This gives you three things: privacy (nobody can read the data), integrity (nobody can tamper with it) and authentication (you're talking to the real site).
Why HTTPS matters for your website
- Trust: visitors are put off by "Not secure" warnings, especially on forms and checkouts.
- SEO: Google uses HTTPS as a ranking signal.
- Features: modern browser features such as HTTP/2, geolocation and many payment tools only work over HTTPS.
- Security: it stops login details being stolen on public Wi-Fi and stops networks injecting ads into your pages.
Every website should use HTTPS, not just shops. Even a simple blog has a login page.
HTTP vs HTTPS
HTTP sends everything in plain text on port 80. HTTPS encrypts it and normally uses port 443. HTTPS used to be thought of as slower, but that's no longer true. Modern TLS is fast, and HTTPS enables HTTP/2 and HTTP/3, which usually make sites quicker than plain HTTP.
Common HTTPS problems
- Mixed content: the page loads over HTTPS but some images or scripts still use
http://, so the padlock disappears. Update the links to HTTPS. - Expired certificate: browsers show a full-page warning. Automatic renewal prevents this.
- Not redirecting: both versions load, splitting visitors and search signals. Add a 301 redirect from HTTP to HTTPS.
- Certificate name mismatch: the certificate doesn't cover
wwwor a subdomain.
AblePage issues free SSL certificates on every plan and renews them automatically, so HTTPS is ready as soon as your domain points at your hosting.