# HTTPS (security)

> HTTPS is HTTP encrypted with TLS. It keeps passwords, forms and cookies private on the way between the visitor and the server.

- **Check ID:** SEC1
- **Area:** [Security](https://be1st.ai/glossary/security)
- **Tool:** [SEO + Security + Performance](https://be1st.ai/tools/ssp-audit)
- **Page:** https://be1st.ai/glossary/security/https

## Why it matters

Without HTTPS, an attacker on the network can intercept and modify data transmitted between the user and the website (man-in-the-middle attack). Modern browsers mark HTTP pages as 'Not Secure' and many APIs (geolocation, camera, service workers) work exclusively over HTTPS. Google also uses HTTPS as a ranking signal.

## In practice

Stripe.com has HTTPS on every page including marketing subpages, not just on the payment form. Conversely, a local e-shop without HTTPS displays a 'Not Secure' warning in Chrome's address bar, which discourages customers from making a purchase.

## How be1st checks it

Checks whether the website uses the secure HTTPS protocol instead of unencrypted HTTP. HTTPS encrypts communication between the browser and server using a TLS certificate, protecting sensitive data (passwords, payment information) from eavesdropping. The check also verifies the certificate: expiry, hostname mismatch, self-signed certificates and an incomplete certificate chain.

[SEO + Security + Performance](https://be1st.ai/tools/ssp-audit), Security tab.

Every check ends as: Pass, Warning, Fail.

## Sources

- [Why HTTPS Matters](https://web.dev/articles/why-https-matters) (web.dev)
- [Transport Layer Security (TLS)](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Transport_Layer_Security) (MDN)

## Related terms

- [HTTPS (SEO)](https://be1st.ai/glossary/seo/https): HTTPS is the encrypted version of HTTP. It protects data between the browser and the server, and browsers mark sites without it as not secure.
- [Strict-Transport-Security (HSTS)](https://be1st.ai/glossary/security/strict-transport-security-hsts): Strict-Transport-Security (HSTS) is an HTTP header that tells browsers to use a website only over HTTPS for a set time, even when someone types or links http://.
- [Content-Security-Policy (CSP)](https://be1st.ai/glossary/security/content-security-policy-csp): Content-Security-Policy (CSP) is an HTTP header that lists the sources a page may load scripts, styles, images and frames from. It is the main defence against XSS.
- [X-Frame-Options](https://be1st.ai/glossary/security/x-frame-options): X-Frame-Options is an HTTP header that decides whether other websites may embed your page in a frame. It protects visitors against clickjacking.
- [X-Content-Type-Options](https://be1st.ai/glossary/security/x-content-type-options): X-Content-Type-Options: nosniff is an HTTP header that stops browsers from guessing a file's type, so a file cannot run as something it was not sent as.
- [Referrer-Policy](https://be1st.ai/glossary/security/referrer-policy): Referrer-Policy is an HTTP header that controls how much of the current URL the browser sends to other sites when a visitor follows a link or a resource loads.