In plain English
Sending a page over plain HTTP is like mailing a postcard: anyone handling it can read it. HTTPS puts it in a sealed envelope that only the person it's addressed to can open.
Used in a sentence
“Every page is served over HTTPS, and the old http addresses redirect to it automatically.”
“Customers told us Chrome was calling our site "Not secure", and it was because we never set up HTTPS.”
In detail
HTTPS works because the site has a certificate that proves it is who it says it is, and lets the browser set up an encrypted connection. Anything typed into the site, from a contact form to a card number, travels scrambled. Without it, browsers warn visitors before they even read a word.
Today HTTPS is simply expected. Google treats it as a small ranking signal, and newer browser features only work on secure pages. Most good hosts include the certificate for free and renew it automatically; the one job left is making sure every old http address redirects to the https one.
Why it matters for your business
Without HTTPS, browsers warn your visitors off before they've seen what you do.
- No "Not secure" warning
- Protects what customers type in
- Expected by Google and browsers
Easy to mix up
HTTPS and SSL are often used to mean the same thing. SSL is the old name for the security behind it; the certificate that makes HTTPS work is still usually called an SSL certificate.
Related terms
SSL certificate, Hosting and Redirect. Or browse the whole glossary.
