Top10VPN is editorially independent. We may earn commissions if you buy a VPN via our links.

HTTP vs HTTPS Explained: Is HTTPS Actually Secure?

Updated Aug 24, 2023

Simon Migliano is a recognized world expert in VPNs. He's tested hundreds of VPN services and his research has featured on the BBC, The New York Times and more.

Fact-checked by JP Jones

Our Verdict

HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are both protocols for transferring information across the web. HTTPS uses encryption to protect your data from eavesdropping or tampering as it is transferred. HTTP transfers data in plain text, exposing it to interception or manipulation by third parties. While HTTPS is safer than HTTP, it can’t guarantee protection from phishing scams, malware, or other website vulnerabilities.

HTTP and HTTPS are foundational aspects of website function and security.

Most people know that HTTPs websites are supposed to be safer than their HTTP alternatives, but do you actually know the difference between them, and how safe are they really?

Quick Summary: HTTP vs HTTPS Websites

HTTP (Hypertext Transfer Protocol) is a network protocol standard that enables different systems to communicate over a network. HTTP does not use encryption, which means that data sent over an HTTP connection is visible as plaintext to anyone who might intercept the traffic.
HTTPS (Hypertext Transfer Protocol Secure) is a more secure version of HTTP that uses SSL or TLS encryption to keep data safe during transmission. HTTPS is essentially HTTP with the addition of encryption and verification, which prevents data from being intercepted and understood by unauthorized third parties.

In this guide, we’ll explain what HTTP and HTTPS mean, how they’re different, and how they affect your online security.

We’ll also determine exactly how safe HTTPS websites are, so you know when to take additional measures to protect yourself.

EXPERT TIP: While an HTTPS connection can enhance your security, it can’t protect you from every threat. HTTPs will not hide the websites you visit from your ISP, either.

For improved security, we recommend using a VPN to add an additional layer of encryption to your web traffic. Top-rated VPN services like ExpressVPN use military-grade AES-256 encryption, and can be used free for 30 days.

HTTP vs. HTTPS: What's the Difference?

HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) are both protocols for transferring information across the web. The main difference between the two is the level of security they provide.

You can identify websites using HTTPS by looking for the padlock in your browser’s address bar.

HTTP transfers data in plain text, making it vulnerable to potential interception or tampering. This increases the risk of data breaches or threats such as Man-in-the-Middle (MitM) attacks.

HTTPS is essentially a secure version of HTTP. It uses SSL (Secure Sockets Layer) or TLS (Transport Layer Security) to encrypt and authenticate the data transferred, ensuring that data cannot be intercepted and understood by unauthorized entities.

While HTTPS significantly improves your security, it’s not 100% secure. It can protect your data from eavesdropping or tampering as it travels between your browser and the server, but it cannot guarantee absolute safety from all forms of cyber threats.

You’re still vulnerable to phishing scams, malware, and other vulnerabilities when you’re browsing a HTTPS website. In addition, your ISP can still see all of the websites you visit.

To fully understand the differences between HTTP and HTTPS, we’ll explain each protocol in more detail in this section:

What does HTTP Actually Mean?

In simple terms, HTTP is a universal language that allows the internet to function. As a network protocol standard, it governs how requests are formatted and transmitted between different browsers and web servers, and what actions should be taken in response to specific commands.

Whenever you enter a URL into your browser, that request for information stored on a web server is transmitted via HTTP, allowing communication between disparate systems and devices.

What does HTTPS Actually Mean?

HTTPS fulfills the same function as HTTPS but with an added layer of encryption and validation. It uses either Secure Socket Layer (SSL) or Transport Layer Security (TLS) to protect the data sent between a browser and a web server.

HTTPS connections also use public key encryption to verify that the server being connected to is the legitimate host of the website.

HTTPS encryption and authentication prevents cyber attacks such as DNS hijacking, man-in-the-middle attacks, and domain spoofing, which are much more common with regular unsecured HTTP connections.

The Differences Between HTTP and HTTPS Summarized

Here’s a table explaining the main differences between HTTP and HTTPS:

Attribute	HTTP	HTTPS
Speed	Fast	Fast
Encryption	No	Yes
Data transmission	Hypertext	Encrypted via SSL or TLS
Authentication	No	Yes
Port number used	80	443
Compatibility	Wide ranging	Wide ranging
Use cases	Unsecured communication between browsers and websites	Secured communication between browsers and websites

Speed: Because HTTPS requires a SSL handshake to initiate encryption, it could be slightly slower than HTTP. However, the computational difference between the two protocols is almost negligible.
Encryption: HTTP is entirely unencrypted, making it relatively easy for malicious actors to access the data moving between browser and web server. HTTPS uses asymmetric public key cryptography to secure the data being transmitted.
Data transmission: HTTP transmitted information in open Hypertext, meaning anyone who intercepts it can read the data. HTTPS transmits the data in an encrypted form, meaning even if it is intercepted, it cannot be read.
Authentication: HTTP offers no form of website authentication. HTTPS uses SSL certificate authentication to verify that a website is secured.
Port number used: By default, HTTP communication uses port 80 while HTTPS uses port 443.
Compatibility: Since both HTTP and HTTPS are foundational aspects of how the internet works, they are both compatible with the vast majority of browsers and web servers.
Use cases: Both HTTP and HTTPS are used to facilitate communication between browsers and web servers, with HTTPS offering more secure encrypted communication.

The Security Risks of HTTP Websites

HTTP websites suffer from various security issues due to the lack of encryption and authentication between your browser and the web server. This makes it far easier for attackers to intercept private data, or to redirect your web traffic to malicious websites.

These vulnerabilities mean that HTTP websites should not be considered secure, and you should be careful of the data you share on them.

Here’s a list of more detailed reasons why HTTP isn’t safe, and why you should avoid HTTP-only websites:

HTTP Data is Not Encrypted

The most glaring security issue with HTTP websites is the fact that the information being transmitted between your browser and the web server is not encrypted.

Our Wireshark tests show our browsing activity was left visible connecting over HTTP.

The lack of encryption makes HTTP connection a prime target for man-in-the-middle attacks, where malicious actors intercept — or even alter — the data being transmitted between your browser and the server.

No Website Validation

HTTP connections do not offer any form of website validation or authentication, either. This means it’s possible for bad actors to set up fake websites with similar URLs to fool unsuspecting users into entering their credentials.

Domain spoofing is when malicious actors impersonate legitimate websites.

Domain spoofing, as this technique is known, could give malicious actors access to a user’s personal data.

HTTP Sites Can Be Redirected

By using a technique referred to as DNS hijacking, cybercriminals can redirect traffic using insecure HTTP connections to malicious websites. These websites are often designed to look identical to the legitimate website, with the goal of stealing a user’s personal information.

Your ISP Can Monitor Every Web Page You Visit

Browsing with HTTP does not give you any privacy from your ISP at all. Unless you use a VPN, your ISP can monitor and record the domain name and any subpages or files you’re accessing on that domain.

In this scenario, all of the content that you send to and receive from the site can be seen by your ISP. This includes the actual text and images of the webpage, along with any search queries or other information you enter.

Are HTTPS Websites Completely Safe?

HTTPS significantly enhances your online security compared to HTTP. Encrypting the data that is sent between your browser and the website you’re visiting makes it considerably more difficult for anyone to intercept or tamper with your data.

However, HTTPS isn’t perfect, and it doesn’t guarantee that a website is legitimate and secure, or that your data is private. Here are some reasons why:

SSL/TLS Vulnerabilities

The security of HTTPS is based on SSL/TLS (Secure Sockets Layer/Transport Layer Security) protocols, which have occasionally been found to have vulnerabilities. While these are usually patched quickly, there is always a risk that a newly discovered vulnerability could be exploited.

Man-in-the-Middle Attacks

In some cases, a malicious party may still be able to execute a man-in-the-middle attack to intercept the data between you and the website you’re visiting.

Man-in-the-middle attacks can still occur with HTTPS connections, particularly on public WiFi.

This is much more difficult with HTTPS, but it can be possible if they have access to the website’s private SSL keys or if they can exploit a vulnerability in the SSL/TLS protocol.

Phishing Attacks

HTTPS only secures the connection between you and the website you’re visiting. It does not verify the content on the website itself.

If a website is set up to scam users or phish for their information, it can still do so over a secure HTTPS connection. Put simply: a phishing website is just as likely to use a HTTPS connection as a legitimate website.

Certificate Authority Issues

The certificates that verify a website’s identity for HTTPS are issued by Certificate Authorities (CAs). If a CA is compromised or behaves maliciously, they could issue fraudulent certificates that would allow an attacker to impersonate a legitimate website.

Mixed Content

If an HTTPS website includes resources (like images or scripts) from a non-HTTPS source, your browser may load this non-secure content, potentially leaving some of your interactions vulnerable.

HTTPS Does Not Guarantee Public WiFi Security

Thanks to the adoption of HTTPS, public WiFi networks are much safer than they used to be. Now it’s much harder for attackers to intercept or manipulate your communications to websites on open networks, because the data is no longer in plain text.

HTTPS creates a secure connection, but it can’t protect you from all potential security risks.

However, HTTPS doesn’t make public WiFi completely safe. Most importantly, it won’t protect your DNS queries — where an attacker intercepts your DNS requests and redirects you to an alternative server under their control.

Your ISP Can Still See The Websites You Visit

While HTTPS can prevent most third parties from monitoring the details of your web traffic, it doesn’t prevent your ISP from monitoring the websites you visit.

When you visit a HTTPS website, your ISP can see and record the name of the website you’re visiting, but not the specific page. Your ISP can also monitor how long you spend on each web page, the device you’re using, connection timestamps, and the size of your requests.

If legally obliged to do so, your ISP can also use deep packet inspection (DPI) to identify the files or web pages you’re accessing — although this is very unlikely.

What Can HTTPS Not Do?

Here’s a brief summary of some of the most common misconceptions associated with HTTPS:

HTTPS does not guarantee that the website you’re visiting is legitimate or secure.
HTTPS will not prevent DNS hijacking or other techniques used to redirect your traffic.
HTTPS will not hide your identity from third parties.
HTTPS will not hide your activity from your ISP.
HTTPS will not stop data breaches.
HTTPS will not protect you from every risk associated with public WiFi networks.

While HTTPS is a significant step towards safer web browsing, it doesn’t guarantee total safety. It is just one part of a broader security ecosystem, which includes other tools like strong passwords, two-factor authentication, VPN encryption, and general browsing best practices.

Do You Need a VPN If You Use HTTPS Websites?

If you’re concerned about your online privacy and security, using a VPN in combination with HTTPS is an excellent way to add an additional layer of protection.

Making sure to use HTTPS websites goes a long way to protect you online, but it can not match or exceed the level of protection provided by a premium VPN service.

While HTTPS secures your communication with a particular website, a VPN extends that security to your entire internet connection. It creates an encrypted tunnel between your device and a remote VPN server, protecting all of your web traffic — not just the data exchanged with HTTPS-secured websites.

how a virtual private network (VPN) works

VPNs create an encrypted tunnel between your device and a remote server.

This means your ISP (Internet Service Provider), government, and potential eavesdroppers on the same network (e.g. on a public WiFi network) cannot see what you’re doing online or where you are connecting from, as your actual IP address is hidden.

Here’s how using a VPN combination with HTTP helps to enhance your privacy and security:

Fully Encrypted Web Traffic

Where HTTPS only encrypts your browser traffic, a VPN provides end-to-end encryption of all the data leaving your device.

If you’re using a high-quality VPN, this encryption will use the AES cipher with a 128-bit key or higher, which is far more secure than the TLS/SSL encryption used by HTTPS connections.

Improved Privacy & Anonymity

Unlike a VPN, HTTPS is not designed to preserve your privacy or anonymity online.

While a VPN doesn’t guarantee anonymity, it does provide an additional layer of privacy, making it harder to track your activities.

A VPN can hide the following information from your ISP and other third parties:

Your personal IP address
Your geographic location
The websites you visit
The apps you use
Time spent on websites and apps
What files you download or upload

Protection Against DNS spoofing

One of the major issues with HTTPS is that it does not encrypt your DNS requests. This makes them vulnerable to DNS spoofing, a process where malicious actors can redirect your requests to false websites.

Using a VPN helps to protect you against DNS leaks and mitigates one of the biggest risks associated with HTTPS.