What is HTTPS, and does your website need it?

What HTTPS is

HTTP is the language browsers and servers use to exchange pages. HTTPS is the same language inside a TLS connection, which provides three things:

• Encryption: nobody between the visitor and the server can read the traffic.
• Integrity: nobody can change the page in transit, for example to inject ads or malware.
• Authentication: the certificate proves the visitor is talking to the real domain.

Does every site need it?

Yes, including sites without logins or payments. Without HTTPS, Wi-Fi operators, internet providers and attackers on the same network can see which pages people read, and can modify pages on the way. Chrome and other browsers mark HTTP pages as Not secure, many modern browser features only work on HTTPS, and Google uses HTTPS as a lightweight ranking signal.

How to switch from HTTP

• Get a certificate. Most hosts and CDNs issue one automatically, and Let's Encrypt is free.
• Make sure every page, image, script and stylesheet loads over https://.
• Redirect every HTTP URL to its HTTPS equivalent with a single 301.
• Update canonicals, sitemaps and internal links to the HTTPS URLs.
• Add the HTTPS property in Google Search Console, or use a domain property that covers both.
• When everything works, add Strict-Transport-Security so browsers stop trying HTTP at all:

Strict-Transport-Security: max-age=31536000

The mistakes that break it

• Mixed content: an HTTPS page that loads a script or image over http://. Browsers block or upgrade it, and the padlock warning returns.
• No redirect from HTTP, so both versions stay live and split links and signals.
• Redirect loops behind a CDN, when the CDN talks to the origin over HTTP and the origin redirects to HTTPS.
• An expired certificate after automatic renewal stopped working.

HSTS with includeSubDomains is hard to undo. Make sure every subdomain serves valid HTTPS before adding it.

What a scan can and cannot tell you

WebAuditOS checks that the site is served over HTTPS, that HTTP redirects to it, that HTTPS pages do not reference images, scripts, stylesheets or frames over http://, and that HSTS is set with a lifetime of at least six months. It also checks the certificate's validity and expiry.

Its mixed content check reads the HTML source, so resources requested later by JavaScript or from CSS are outside it. The browser console shows those.

A closed port 80 passes the redirect check, because nothing is served over HTTP. Visitors who type the domain without https may then see an error instead of being redirected.

Short answers

Is HTTPS free? Yes. Let's Encrypt and most hosts provide certificates at no cost.

Does HTTPS make a site safe? It secures the connection. It says nothing about whether the site itself is honest or secure.

Does HTTPS slow a site down? Not noticeably. TLS 1.3 and HTTP/2 often make HTTPS faster.

Will switching to HTTPS hurt SEO? Not if every HTTP URL redirects to its HTTPS equivalent.