What does HTTPS stand for?

HTTPS stands for Hypertext Transfer Protocol Secure. It's HTTP, the set of rules browsers use to load web pages, with encryption added, so nobody between your browser and a website can read or change what passes between them.

What does HTTPS mean?

HTTPS means a web page reaches you over a secure connection. Hypertext is the linked pages that make up the web, a transfer protocol is the set of rules a browser and a server follow to exchange those pages, and Secure means the exchange is encrypted.

When you log in, send a contact form or pay by card on an HTTPS page, what you type is encrypted on its way, so only your browser and the website can read it. On public Wi-Fi in a café, for example, nobody else on the network can intercept it or change it.

To check whether a page uses HTTPS, look at the web address. The address then starts with https:// before the domain name, and in Chrome the security symbol to the left of the address shows whether the connection is secure.

How does HTTPS work?

HTTPS works by running ordinary HTTP over an encryption protocol called TLS, short for Transport Layer Security. TLS encrypts the connection, and a digital certificate tells your browser which website is at the other end.

Browsers only set up a secure connection when the server shows a valid certificate confirming its identity, so you know you're talking to the website in the address bar and not to someone pretending to be it. That certificate comes from a certificate authority, which checks that whoever asks for one really controls the domain, and browsers trust the certificates it issues.

HTTPS also uses its own port, the numbered entry point on a server that a connection goes to. An https:// address connects to port 443 by default, and a plain http:// address to port 80. An address that leaves the port out uses that default, so you don't need to type one.

What is the difference between HTTP and HTTPS?

HTTPS encrypts what passes between your browser and a website, and HTTP doesn't. HTTP sends everything as it is, which is why it isn't secure: anyone who can see the connection could read what you send and alter it.

Is SSL the same as HTTPS?

No. SSL, short for Secure Sockets Layer, was the older technology for encrypting the link between a server and a browser, and TLS has replaced it. HTTPS today runs on TLS, but the old name has stuck: to use HTTPS, your domain needs what is still called an SSL certificate, even though the connection it sets up uses TLS. So when a hosting plan includes SSL, it includes the certificate that lets your website run on HTTPS.

Does HTTPS mean a website is safe?

No, HTTPS on its own doesn't mean a website is safe. It keeps your connection to the website private and encrypted, but it says nothing about whether the people running the site are honest. Any website can use HTTPS, including fake sites built to trick you into handing over passwords or card details.

So treat the security symbol as a starting point, not a seal of approval. Before you type a password or card details, check the site name in the address bar to make sure you're on the right site. Take extra care with links in unexpected emails and texts, because phishing and other email threats work through them: a scam message links to a website built to get your password or your money.

For your own website, HTTPS is one layer of protection among several, and you'll find the others in our tips to secure your website.

What happens if your website doesn't use HTTPS?

If your website still runs on plain HTTP, your visitors get a warning. Chrome marks a page without a private connection as Not secure and tells visitors that others could see or alter what they send. On a page with a contact form, a login or a checkout, that's a good reason for people to leave before they type anything.

It can also cost you a little in search. When Google started using HTTPS as a ranking signal, it called it a very lightweight signal that counts for less than high-quality content. HTTPS won't lift a weak page to the top, but there's no reason to give that signal away.

How to get HTTPS on your website

To run on HTTPS, your website needs an SSL certificate on the server where it's hosted. If another provider hosts your website, ask them how to add a certificate to your plan. When we host your website, we issue the certificate for you. It's a wildcard certificate from Let's Encrypt, so it also covers the subdomains of your domain, such as shop.yourbusiness.co.uk.

1. Host your website with us on one of our hosting plans, which all include SSL.
2. Make sure your domain uses our name servers: when it does, we issue and activate its SSL certificate. A domain registered with us uses them by default. If yours is registered elsewhere, point its name servers to us. If your email runs with another provider, add its DNS records with us as well, so your email keeps working.
3. Give the certificate time to start working. If HTTPS still doesn't work more than 24 hours after your domain started using our name servers, something else may be wrong.
4. Redirect HTTP to HTTPS, so every visitor gets the secure version, even when they type http:// or follow an old link.
5. If your site runs on WordPress, install and activate the Really Simple Security plugin to fix mixed content: images and other files the page still loads over HTTP.

When you've done this, open your site in a browser and check that the address bar shows a secure connection. If it doesn't, and the 24 hours in step 3 have passed, check that your domain uses our name servers, then get in touch with our support team.

An SSL certificate comes with every hosting plan, so your website can run on HTTPS.

With HTTPS in place, visitors can trust the connection to your site. If you're starting a new site, our website builder includes SSL, so you can build your website and publish it on HTTPS from the start.