What is HTTPS?
HTTP encrypted with TLS, the same protocol, but every byte on the wire is authenticated and protected from eavesdroppers.
HTTPS is HTTP running inside a TLS-encrypted tunnel. The application-layer semantics are unchanged, you still send GET / and receive a status code, but the bytes that move between client and server are encrypted, integrity-checked, and authenticated against a server certificate.
In 2026, HTTPS is effectively mandatory. Browsers mark plain HTTP as "Not secure," HTTP/2 only runs over TLS in practice, and mixed-content rules block subresources loaded over HTTP from HTTPS pages. Free certificates from Let's Encrypt removed the last cost objection a decade ago.
When you fetch an HTTPS URL, your client validates the server's certificate against a chain of trusted CAs, negotiates a session key, and then exchanges normal HTTP messages over that encrypted channel. The cost is a small handshake overhead on the first connection, usually 1-2 round trips, that disappears with TLS 1.3 session resumption.