HTTP and HTTPS

Build the mental model

HTTP is the protocol browsers and servers use to exchange requests and responses. Plain HTTP sends that conversation as readable text, so anyone on the network path can potentially read it.

HTTPS is HTTP layered on top of TLS, encrypting the connection. This is why it matters: passwords, payment details, and personal data stay unreadable to anyone eavesdropping between browser and server.

Most modern hosting platforms automatically issue and renew certificates for you, often through the free Let's Encrypt service, so a correctly configured deployment gets HTTPS essentially for free. This lesson points the TLS handshake mechanics to the Networking tutorial on this site.

HTTP VS HTTPS
-------------
 HTTP (plain text)
 Browser ------ readable data ------> Server
              (anyone on the network could read it)

 HTTPS (encrypted with TLS)
 Browser ==== encrypted data ====> Server
              (only browser and server can read it)

Connect it to a real scenario

The isSecure function below takes a URL string and returns whether it uses HTTPS, by checking if the string starts with https colon slash slash. It is also written to be safe in a browser context: if no URL is passed in and a window object exists, meaning the code is actually running inside a real browser, it falls back to reading the current page's own address instead of crashing.

This kind of check is genuinely useful in real applications, for example to warn a user, or to redirect them automatically, if they somehow land on an insecure version of your site. Running the function against a plain HTTP example, a secure HTTPS domain, and a secure HTTPS URL with a path shows the boolean flip clearly between the two protocols.

Notice what this function cannot tell you anything about: it has no idea whether the server behind that HTTPS URL has good passwords, patched software, or a secure database. It only reports one narrow, genuinely important fact, whether the connection itself would be encrypted, which is exactly the boundary this lesson's warning about HTTPS is pointing at.

• HTTPS is HTTP with TLS, which encrypts the connection
• HTTPS only protects data in transit, it does not make an application "100% secure"
• Most modern hosting platforms automate certificate issuance through services like Let's Encrypt

Try the working example

function isSecure(url) {
  if (typeof window !== "undefined" && !url) {
    url = window.location.href;
  }
  return url.startsWith("https://");
}

const urls = [
  "http://example.com",
  "https://thutatech.com",
  "https://learn.thutatech.com/path"
];

for (const url of urls) {
  console.log(`${url} -> secure: ${isSecure(url)}`);
}

http://example.com -> secure: false
https://thutatech.com -> secure: true
https://learn.thutatech.com/path -> secure: true

MDN Glossary: HTTPS — Cloud & Deployment