Each time you visit a website through your browser, you’re using the Hypertext Transfer Protocol (or HTTP, for short) to move data between your computer or mobile device and a web server. HTTP involves transferring information in plain text—an open, unencrypted process that can leave sensitive data vulnerable.
That said, if your site collects and stores users’ private information, it’s crucial that you take precautionary measures to protect your clients’ data. It’s essential that you shield your site from cyberattacks by encrypting it with Hypertext Transfer Protocol Secure, or HTTPS. In HTTPS—which is signaled by a padlock-shaped icon next to a site’s address—the communication protocol is encrypted using Transport Layer Security (TLS), formerly known as Secure Sockets Layer (SSL). Doing so protects against data tampering, “eavesdropping,” and other malicious acts carried out by hackers. Having a HTTPS connection is particularly important over open, unsecure networks, such as public Wi-Fi access points.
So what exactly does HTTPS do differently than HTTP?
It relays communications between you and a server in the exact same way—except it adds a TLS layer that encrypts and decrypts their requests and responses. That means that even though hackers can intercept the messages you exchange with a server, they won’t be able to make sense of the transmitted data. In short, the fortified connection provides authentication and guarantees the privacy and integrity of a site.
Obtaining a HTTPS certificate used to be an expensive and complex ordeal—so initially, only companies that required the transfer of sensitive information (such as credit card numbers) offered the added layer of security. But nowadays, the certificates are available free of charge through many accredited services such as Let’s Encrypt, a nonprofit backed by the Internet Security Research Group (ISRG) that has provided TLS certificates to over 300 million websites.
Whichever service you choose, make sure it’s offered by a legitimate company. Otherwise, if your TLS certificate is invalid, most browsers will warn users not to advance to your site, automatically flagging it as a potential security risk.
If you’re afraid a TLS certificate will make your site run slower, think again: Though that might have been true 20 years ago (when the technology was still new), it’s certainly no longer the case. Just consider the fact that there are roughly 99,000 Google queries per second—and they’re all conducted over HTTPS by default. To boot, when the search engine giant switched to HTTPS in 2010, it revealed that it didn’t have to deploy any additional machines or special hardware. That’s because SSL/TLS certificates accounted for less than 1% of the CPU load and under 10KB of memory per connection, proving that they have limited impact on web performance. (Want more proof? Try this HTTP vs. HTTPS test to see how each protocol impacts your page load speed.)
Still not convinced you should upgrade to HTTPS? Keep in mind that Google gives preference to encrypted sites, ranking them higher than unsecure ones. So if you want to ensure yours is always displayed at the top, it’s a no brainer—flip the switch.