HTTPS is HTTP with encryption. When you visit a site over HTTPS, everything between your browser and the server is encrypted — passwords, credit cards, personal data, even the pages you view. Nobody in between (your ISP, the coffee shop WiFi, hackers) can read or modify the traffic.

The S stands for Secure. The padlock icon in your browser means HTTPS is active.

HTTP vs. HTTPS

HTTP (no encryption):

You → [password: hunter2] → WiFi router → ISP → Server
         ↑ Anyone can read this

HTTPS (encrypted):

You → [encrypted gibberish] → WiFi router → ISP → Server
         ↑ Nobody can read this except the server

How it works (simplified)

1. Your browser connects to https://example.com
2. The server sends its SSL certificate (which contains its public key)
3. Your browser verifies the certificate is valid and trusted
4. Browser and server agree on an encryption key using a handshake
5. All data is now encrypted with that key

This happens in milliseconds, before any page content loads.

Why every site needs HTTPS

• Security — protects user data from eavesdropping
• SEO — Google ranks HTTPS sites higher
• Trust — browsers show “Not Secure” warnings for HTTP sites
• Required for modern features — service workers, geolocation, camera access all require HTTPS
• HTTP/2 and HTTP/3 — only work over HTTPS in browsers

Setting up HTTPS

The easy way — Let’s Encrypt (free):

# Install certbot
sudo apt install certbot python3-certbot-nginx

# Get a certificate (auto-configures Nginx)
sudo certbot --nginx -d example.com -d www.example.com

# Auto-renewal is set up automatically
# Test it:
sudo certbot renew --dry-run

That’s it. Free SSL certificate, auto-renews every 90 days.

Platforms that handle it for you:

• Vercel, Netlify, Cloudflare Pages — automatic HTTPS
• Cloudflare (as a proxy) — free SSL for any site
• AWS Certificate Manager — free certificates for AWS services

Redirect HTTP to HTTPS

After setting up HTTPS, redirect all HTTP traffic:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

See: Nginx cheat sheet for more config patterns.

Common issues

• Mixed content — your HTTPS page loads resources over HTTP. See: HTTPS mixed content fix
• Certificate expired — Let’s Encrypt certs last 90 days. Make sure auto-renewal is working.
• SSL certificate problem — See: SSL certificate problem fix

SSL vs. TLS

People say “SSL” but mean “TLS.” SSL is the old, insecure version. TLS is the current standard (TLS 1.2 and 1.3). The terms are used interchangeably in casual conversation, but technically you should use TLS.