HTTPS is the secure version of HTTP. It encrypts the connection between a visitor's browser and your website so nobody in between can read or tamper with the data. Every modern site needs it — browsers now label sites without it as "Not secure".
HTTPS (Hypertext Transfer Protocol Secure) is HTTP wrapped in TLS encryption. It protects passwords, payment details and page content from eavesdropping and tampering, and it is now the baseline expectation for any legitimate website.
Check your website
See how your site handles what is https and why does your website need it? — free, no account needed.
For business owners
When a visitor sees "Not secure" in the address bar, they leave. HTTPS is the single most visible trust signal on the web: the padlock tells customers their information is safe with you. Beyond trust, HTTPS is required for card payments, improves search rankings, and is mandatory for many modern browser features. If your site still runs on plain HTTP, you are almost certainly losing customers before they even read your homepage.
How it works (technical)
HTTP sends data as plain text. Anyone on the same network — a coffee-shop Wi-Fi, an ISP, a compromised router — can read it. HTTPS layers the TLS protocol underneath HTTP. During the TLS handshake the browser and server agree on encryption keys, verify the server's certificate, and from then on every request and response is encrypted and integrity-checked.
HTTPS provides three guarantees: confidentiality (data is encrypted), integrity (data cannot be altered in transit), and authentication (you are really talking to the domain you think you are).
Real-world example
A small e-commerce shop kept its checkout on HTTP to "save money on a certificate". Chrome began showing a full-page "Not secure" warning on the payment form. Conversion dropped 30% overnight. After installing a free Let's Encrypt certificate and redirecting all traffic to HTTPS, the warning disappeared and conversions recovered within days.
Why it matters
HTTPS is a ranking signal for Google, a hard requirement for PCI-compliant payments, and the difference between a browser showing a padlock or a scary warning. It also unlocks HTTP/2 and HTTP/3 performance and browser APIs like geolocation and service workers that refuse to run on insecure origins.
How to fix it
Obtain a TLS certificate. Free options like Let's Encrypt are trusted by all major browsers; most hosts offer one-click installation.
Install the certificate on your web server or enable it in your hosting control panel.
Redirect all HTTP traffic to HTTPS with a permanent (301) redirect so old links and search results update.
Update internal links, canonical tags and your sitemap to use
https://.Add the HSTS header so browsers remember to always use HTTPS.
Re-scan your site to confirm no "mixed content" (HTTP resources on an HTTPS page) remains.
Best practices
Automate certificate renewal so it never silently expires.
Enforce HTTPS site-wide, not just on the checkout or login page.
Enable HSTS with a sensible max-age once you are confident HTTPS works everywhere.
Serve all images, scripts and fonts over HTTPS to avoid mixed-content warnings.
Common mistakes
Only securing the login or payment page and leaving the rest on HTTP.
Forgetting to renew the certificate, causing a hard browser error for every visitor.
Leaving hard-coded
http://resource URLs that trigger mixed-content warnings.Using a 302 (temporary) redirect instead of a 301 for the HTTP-to-HTTPS move.
Frequently asked questions
Is HTTPS the same as SSL?
Almost. HTTPS is HTTP secured by TLS, the modern successor to SSL. People still say "SSL certificate" out of habit, but the protocol actually in use today is TLS.
Does HTTPS slow my site down?
No. Modern TLS is extremely fast and HTTPS unlocks HTTP/2 and HTTP/3, which usually make sites faster, not slower.
Is a free certificate as safe as a paid one?
Yes. A free Let's Encrypt certificate provides the same encryption strength as a paid one. Paid certificates mainly add organisation validation and warranties, not stronger encryption.
Put this into practice
See how your site scores with Plexa Trust — start with a free scan, then unlock the complete audit on Pro.
Scan your website free