What HTTPS actually protects
HTTPS is HTTP carried over an encrypted connection using TLS. It helps protect information in transit and lets the browser verify that it is communicating with a server presenting a certificate valid for the requested hostname. This helps reduce the risk of someone on the network reading or changing data while it travels between the browser and server.
What is an SSL/TLS certificate?
A website certificate helps the browser authenticate the hostname and establish an encrypted connection. Browsers validate certificate details and whether the certificate chains to a trusted certificate authority. Certificates have validity periods and must cover the hostnames visitors actually use.
Does HTTPS mean a website is safe?
No. HTTPS protects the connection; it does not prove that the website operator is honest, that the site's software is free of vulnerabilities, or that a payment request is legitimate. A phishing page can use HTTPS too. Check the domain carefully and be cautious about unexpected requests for personal or financial information.
Why do browsers show 'Not secure' or certificate warnings?
A page may be using plain HTTP, have an expired or mismatched certificate, use an incomplete certificate chain, or have another TLS configuration problem. Browser warnings should be taken seriously. Do not bypass a full-page certificate warning just to continue to a site where you would enter sensitive information.
Why does a site redirect from HTTP to HTTPS?
The redirect guides visitors from an unencrypted URL to the secure version. A site should decide on one preferred hostname and protocol, then make sure alternate versions redirect consistently. Incorrect or conflicting redirects can cause loops or send visitors to an unexpected location.
What is HSTS?
HTTP Strict Transport Security (HSTS) is a response header that tells browsers to use HTTPS for future requests to a domain for a specified period. It can help prevent downgrade to HTTP after a browser has learned the policy. HSTS should be introduced carefully, especially when enabling subdomain coverage.
How can a visitor check HTTPS?
In Chrome, open the page and select the site information control beside the address bar to review connection information. The exact icon and wording can vary. A secure connection is one signal; it is not a general endorsement of the website's content or business.