HTTP vs HTTPS

HTTP (Hyper Text Transfer Protocol) is the protocol that powers the web as we know it.

It sits on top of TCP, which sits on top of IP.

Web pages can either use HTTP or HTTPS (Hyper Text Transfer Protocol Secure).

How are they different? And why does Chrome now ask before loading a public site over plain HTTP?

Security

When you request an HTTP page from a server, the data goes through many different networks, each controlled by a separate company or entity.

Starting from the WiFi router, which might be owned by the coffee shop or by the city public network infrastructure, every single node in the network can see the request and the response, and modify it in any way.

They might inject ads, they might inject malware, they might log any credentials you enter. A server in the middle can play as a man-in-the-middle, sending compromised information.

This also applies to any internet protocol that’s not secured.

HTTPS traffic is end-to-end encrypted, and this means there is nothing in between that can read the information exchanged between you and the server at the other side of the network.

The ports

By default, HTTP is served on port 80, while HTTPS is served on port 443. Those are the default ports, but a web server can choose to serve content on a different, random port, in which case you need to specify it in the address bar:

http://flaviocopes.com
http://flaviocopes.com:80/javascript
https://flaviocopes.com:8081/javascript

Is HTTPS slower?

No! It’s the opposite.

There is a myth around page speed. People think that the TLS handshake required for HTTPS is making page speed slower, but in reality, an HTTPS page can load up way, way faster than HTTP.

Why? Because of HTTP/2. HTTP/2 can serve requests in parallel. Browsers only use it over HTTPS (the spec allows cleartext h2c, browsers don’t), so if your server supports HTTP/2, your pages get a speed bump on HTTPS.

HTTP/2 introduces better parallelism, multiplexing, and compression. That was a big update to HTTP.

The newest version is HTTP/3 (RFC 9114, June 2022). It runs over QUIC, and TLS 1.3 is built into QUIC, so it is encrypted too.

See httpvshttps.com and Troy Hunt’s write-up for a demo.

Does HTTPS affect SEO?

Yes.

In particular, since 2014 HTTPS is a ranking signal.

Chrome 68 (July 2018) started marking HTTP pages as “Not Secure”. Since Chrome 154 (October 2026), Always Use Secure Connections is on by default for public sites. Chrome tries HTTPS first, and it asks before loading a public site over plain HTTP. I also wrote a longer post on the HTTPS protocol.

Is HTTPS difficult to implement?

Not at all. Thanks to free SSL certificates provided by Let’s Encrypt, the push for HTTPS had a huge impact and how every decent hosting provider is implementing it for free on all the accounts. Thanks to this, in 2018 HTTPS connections were more than the HTTP connections.

In the past having an SSL certificate for your site was a premium option that few were willing to purchase for a regular site, that was not making money or didn’t process user data.

Nowadays there’s no excuse.

Want me to talk about your product? You can sponsor this site.