HTTPS (HyperText Transfer Protocol Secure)

HTTPS is HTTP carried over Transport Layer Security (TLS). For a correctly authenticated connection, TLS encrypts requests and responses in transit, detects tampering, and lets the client verify the server identity represented by its certificate. HTTPS protects the connection between TLS endpoints; it does not prove that a website's content, operator, code, or business practices are trustworthy.

Why it matters: Serve every page and first-party resource over HTTPS with a valid, automatically renewed certificate and a current TLS configuration. Redirect each HTTP URL directly to its HTTPS equivalent, update canonical URLs, sitemaps, internal links, forms, API endpoints, and third-party callbacks, and remove or upgrade mixed content. Monitor certificate expiry, handshake failures, redirect loops, and both edge-to-visitor and edge-to-origin connections where a proxy or CDN terminates TLS. Add HSTS only after HTTPS works across every host the policy will cover. Browsers treat HTTPS as a secure context for many web capabilities and may warn on HTTP, but the interface varies. Google has described HTTPS as a lightweight ranking signal, not a guarantee or a substitute for relevant content. HTTPS also does not prevent compromised servers, vulnerable applications, phishing, malicious scripts, or data misuse after it reaches an endpoint.