Short answer: HTTPS is the encrypted version of HTTP: it uses TLS, once called SSL, to encrypt everything between a visitor’s browser and your site. An SSL certificate, issued by a certificate authority, is what lets your server prove its identity and turn that encryption on. web.dev says every site should use HTTPS, even one that handles nothing sensitive.
HTTP and HTTPS side by side
| HTTP | HTTPS | |
|---|---|---|
| Encryption | None | TLS encrypts all communication |
| Tampering | Third parties, such as ISPs, can inject ads | Much harder for intruders |
| Privacy | Each request can reveal visitor behavior | Protected from passive listening |
| Browser features | Many newer ones, such as camera access or offline use, don’t work | Available with the visitor’s permission |
From web.dev, “Why HTTPS matters”, and MDN Web Docs, “HTTPS” and “TLS”, read November 2, 2026.
Why every site needs it
HTTPS keeps intruders from changing what travels between your site and your visitors. Those intruders include attackers and also legitimate but intrusive companies, such as internet providers that inject ads into pages.
It also protects privacy. Even sites that handle nothing sensitive need it, because every unprotected request can reveal something about a visitor’s behavior and identity.
Google’s page experience guidance asks whether your pages are served in a secure fashion, and Search Console’s HTTPS report shows which pages aren’t.
What the certificate covers
A certificate authority vouches for your public key and the names on the certificate, and authorities charge different amounts for it. One certificate can cover several names, such as example.com and www.example.com, or a wildcard such as *.example.com.
A wildcard covers one level only: *.example.com works for shop.example.com but not for a.shop.example.com. If you use several hostnames or subdomains, each needs the right certificate.
From web.dev, “Enabling HTTPS on your servers”.
How to move your site to HTTPS
- Ask your host whether it can issue and install a certificate for your domain.
- Make sure the certificate covers every name you use, with and without www.
- Turn on HTTPS, but don’t redirect HTTP to it yet.
- Load images, scripts and styles with relative addresses, so no HTTPS page pulls in an HTTP file.
- Once every page works over HTTPS, redirect HTTP to HTTPS permanently.
- Turn on HSTS with a low max-age and raise it as you gain confidence.
- Check the HTTPS report in Search Console and fix the pages it lists.
Our guide to 301 redirects covers the permanent redirect from HTTP to HTTPS.
What our own certificate shows
Let’s Encrypt issued our certificate for three names: feedback-studios.com, www.feedback-studios.com and one more subdomain of ours. It runs from October 4, 2026 to January 2, 2027.
The http and www addresses answer with a 301 to https://feedback-studios.com in one step. Our server also sends Strict-Transport-Security with a max-age of 86,400 seconds, one day: a low value, as web.dev suggests for a start.
Before you call your site secure
- Every page opens over HTTPS.
- The certificate covers every name you use.
- HTTP and www addresses redirect permanently to HTTPS.
- No HTTPS page loads images, scripts or styles over HTTP.
- HSTS is on, with a max-age you plan to raise.
- Search Console’s HTTPS report shows no problems.
RememberHTTPS protects every visit, not only payments. Get a certificate that covers all your names, redirect HTTP permanently, avoid mixed content and check the HTTPS report.
If you want us to check your site’s HTTPS setup, see our technical SEO service.
Quick answers about SSL and HTTPS
Is SSL the same as TLS?
TLS is the current version. MDN describes Transport Layer Security as the protocol formerly known as Secure Sockets Layer, and SSL as the old standard that TLS superseded. People still say SSL certificate, but sites today use TLS.
Does my site need HTTPS if it doesn’t sell anything?
Yes. web.dev says to protect all your websites with HTTPS, even if they don’t handle sensitive communications. Every unprotected request can reveal something about your visitors’ behavior and identity, and many browser features only work over HTTPS.
Does HTTPS help with Google?
Google’s page experience guidance asks whether your pages are served in a secure fashion, and Search Console has an HTTPS report that shows which pages aren’t. Serving every page over HTTPS is part of a good page experience.
How does HSTS work?
HTTP Strict Transport Security is a header that tells browsers to always connect to your site over HTTPS, even from an http:// link. web.dev suggests starting with a low max-age, which is measured in seconds, and raising it over time.
Can an HTTPS page still be insecure?
Yes, if it loads some resources over plain HTTP, which is called mixed content. Browsers warn that the page isn’t completely secure, and some refuse to load those resources, which can break the page.
Sources
Read on November 2, 2026. web.dev: Why HTTPS matters and Enabling HTTPS on your servers. Google Search Central: Understanding page experience. MDN Web Docs: HTTPS and TLS. Our own case: our certificate and server, on November 2, 2026.