HTTPS vs HTTP — What Changes at the Wire, in the Browser, and for SEO

HTTP is the plain-text web protocol. HTTPS is the same protocol tunneled through TLS (Transport Layer Security). In 2026, ~98% of Chrome page loads happen over HTTPS. The remaining 2% is niche: intranets, IoT devices, some legacy internal systems. Public internet? HTTPS is mandatory.

What actually differs at the wire

	HTTP	HTTPS
Transport	Plain TCP (port 80)	TLS over TCP (port 443)
Request URL path	Visible to network observers	Encrypted end-to-end
Request headers (incl. Cookie, Auth)	Visible	Encrypted
Response body	Visible	Encrypted
Server hostname (SNI)	N/A	VISIBLE (plaintext) — unless ECH enabled
Client IP + server IP	Visible	Visible (IP is L3, TLS is L7)
Approximate response size + timing	Visible	Visible (TLS doesn't hide sizes)

What HTTPS actually protects against

• Passive network snooping — coffee shop WiFi can't read your requests
• Active MITM injection — a compromised ISP can't inject ads into pages
• Session cookie theft — session hijacking on public networks is neutralized
• Content tampering — page you receive is exactly what the server sent

What HTTPS does NOT protect against

• Server-side attacks — SQL injection, XSS, and RCE all still work over HTTPS
• Compromised endpoints — if the client or server itself is malicious, TLS is irrelevant
• Traffic analysis — an observer can see WHICH sites you visit (via SNI + IP + DNS unless you're using DoH/DoT/ECH)
• Phishing — https://paypa1.com gets a valid cert just as easily as https://paypal.com

Performance — HTTPS is FASTER than HTTP

This is counterintuitive. Yes, HTTPS adds a TLS handshake (~50ms extra on first connection). But HTTPS unlocks:

• HTTP/2 — multiplexing, header compression, server push. Every major browser requires HTTPS for HTTP/2.
• HTTP/3 (QUIC) — replaces TCP+TLS with a single UDP-based handshake. HTTPS-only.
• 0-RTT resumption — repeat connections skip the handshake entirely.
• Better CDN caching — Cloudflare, CloudFront, Fastly all optimize the HTTPS path.

Real-world result: modern HTTPS is 20-40% faster than HTTP/1.1 for a typical page load.

SEO — Google ranks HTTPS pages higher

Google confirmed HTTPS as a ranking signal in 2014 and has strengthened it since. Chrome flags any non-HTTPS page as "Not Secure" in the address bar since 2018 — this alone crushes conversion on plain-HTTP sites. Google's Core Web Vitals metrics also implicitly require HTTPS (the LCP and INP measurements come from the field, and Chrome doesn't send field data for HTTP sites).

Mixed content — the biggest HTTPS migration foot-gun

A page loaded over HTTPS that includes ANY http:// resource (script, CSS, image, iframe) is "mixed content." Browsers now block or auto-upgrade these:

• Scripts, CSS, iframes — BLOCKED
• Images, media — Auto-upgraded to HTTPS; broken if the target doesn't support HTTPS

Fix: use protocol-relative URLs (//cdn.com/file.js) or explicit https://. Never hardcode http://.

HSTS — force HTTPS forever

Strict-Transport-Security header tells the browser "for the next N seconds, use HTTPS for this domain even if a link says http://":

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

The preload hint makes you eligible for Chrome's HSTS preload list — browsers ship with the list baked in, so even a first-time visitor gets HTTPS. Once on the list, you cannot go back to HTTP without breaking every browser that has ever loaded your site.

Free certificates — no reason to be on HTTP in 2026

• Let's Encrypt — 90-day free certs, automated via ACME. Included in nginx, Apache, Caddy.
• Cloudflare — flip a switch on any zone, get a wildcard cert for free.
• ZeroSSL — free 90-day certs with a nicer UI than Let's Encrypt if you want manual.
• AWS Certificate Manager — free for use with CloudFront, ALB, API Gateway.

Related

What is encryption? · AES vs RSA · SSH vs SSL vs TLS.