What are HTTPS and SSL in plain words?

Next to most sites' addresses you see a padlock, and the address starts with https://. What exactly does that padlock guarantee — and what doesn't it?

HTTP vs HTTPS

HTTP is the protocol between your browser and the site. In its plain form, data travels unencrypted, so anyone in the path (say, on public Wi-Fi) can read or alter it. HTTPS is the same HTTP run over an encryption layer called TLS. (The older name was SSL, which stuck in everyday speech; SSL versions are obsolete and today it's all TLS.)

What the padlock guarantees

• Encryption: what travels between you and the server can't be read in transit.
• Integrity: it can't be modified on the way.
• Domain identity: the server holds a certificate issued by a trusted authority for that exact domain.

What it does NOT guarantee

The padlock says the connection is secure — not that the site is honest. Phishing sites can get HTTPS certificates too. So always read the domain itself; common fakes use look-alike letters or hide the real domain inside a subdomain. Detection tips are in the phishing guide.

Where do certificates come from?

TLS certificates are issued by certificate authorities (CAs). Let's Encrypt gives free, automated certificates, and most hosts (including Vercel, Netlify and Cloudflare Pages) enable them automatically — you just connect the domain. Certificates expire and must renew, which these services handle automatically.

For site owners

• Redirect all HTTP addresses to HTTPS.
• Send the HSTS header so browsers use HTTPS next time without asking.
• Make sure every page resource (images, scripts, fonts) loads over HTTPS; mixing causes "mixed content" warnings.
• Watch the certificate expiry if renewal isn't automatic.
• Set the other security headers (CSP, X-Content-Type-Options) too — see this site's vercel.json.

On public Wi-Fi

HTTPS hides page contents from other people, but they can still see which domains you connect to. It's still fine to browse — just treat the network as untrusted and keep 2FA on for important accounts (2FA guide).