If you've ever clicked a website and seen a "Not Secure" warning in the address bar, you've seen HTTP vs HTTPS in action. But what's actually happening behind that padlock, and does it matter for your site?

The three things HTTPS actually protects

1. Encryption in transit

Without HTTPS, every byte between your browser and the server is sent as plain text. Anyone on the same Wi-Fi network, any ISP along the route, and any compromised router in between can read the data. With HTTPS, that data is encrypted end-to-end using TLS.

2. Integrity

HTTPS guarantees that the data your browser receives is exactly what the server sent. Without it, a man-in-the-middle attacker can modify the response in transit — injecting malware, swapping out download links, or rewriting page content.

3. Authentication

The certificate proves that the server you're talking to is actually the one that owns the domain. Without this, an attacker can pretend to be your bank and serve a perfect clone of the login page.

What HTTPS does NOT protect

Despite what some marketing pages imply, HTTPS doesn't make a site "secure" in the broader sense. It only protects the transport. The site itself can still be hacked, have a vulnerable CMS, leak data through application bugs, or serve malicious ads. HTTPS is necessary but not sufficient.

Performance: HTTPS is faster now

There was a time when HTTPS sites were noticeably slower because of the TLS handshake. That hasn't been true since 2010. With HTTP/2 (which requires HTTPS in most browsers) and TLS 1.3, HTTPS sites are routinely faster than HTTP sites because they support multiplexing, server push, and 0-RTT handshakes.

SEO impact

Google has used HTTPS as a ranking signal since 2014. The boost is small (under 1% of the algorithm), but it's free, so there's no reason not to have it.

Browser behavior

Since Chrome 68 (July 2018), HTTP pages are marked "Not Secure" in the address bar. Firefox, Safari, and Edge all do the same. For most users, this is a strong signal to leave the page — especially for any kind of login, payment, or form submission.

Bottom line

There's no good reason to ship an HTTP-only site in 2026. Free certificates are available, the performance penalty is gone, and browsers actively warn users away from HTTP. If your site is still on plain HTTP, that's the first thing to fix.