The paramount responsibility of any web developer or owners of websites is to secure the data and information of the website visitors,to be able to achieve that, there is need for both the owners of websites and the developers to understand the differences between HTTP and HTTPS with regard to data and information security.

What is HTTP?

HTTP stands for Hypertext Transfer Protocol. When you enter http:// in your address bar in front of the domain, it tells the browser to connect over HTTP. HTTP uses TCP (Transmission Control Protocol), generally over port 80, to send and receive data packets over the web. To put it simply it is a protocol that’s used by a client and server which allows you to communicate with other websites. The client sends a request message to an HTTP server (after the TCP handshake) which hosts a website, the server then replies with the response message. The response message contains completion status information, such as HTTP/1.1 200 OK.

TCP has had enhancements over the years but for the most part is very much the same as it was when it first defined in 1974, . HTTP also uses UDP (User Datagram Protocol), designed by David Reed in 1980,it is less reliable but widely used in video conferencing, video games, and streaming. It allows individual packets to be dropped and received in a different order for better performance.

The term hypertext originally came from Ted Nelson in 1965. The original HTTP was developed and originally proposed byTim Bernes Lee, the director of the World Wide Web Consortium (W3C). The W3C’s mission is to lead the web to its full potential by developing protocols and guidelines that ensure the long-term growth of the web.

There was a time when people felt the internet was another world, but now people realize it’s a tool that we use in this world.

– Tim Berners-Lee

The first documentation of HTTP was published in 1991 as HTTP 09 which only consisted of one HTTP request method, GET (requests data from a specified resource). In 1996 HTTP 1.0, , was developed and this consisted of three HTTP request methods, GET, HEAD, and POST (submits data to be processed to a specified resource). Finally in 1997, the HTTP/1.1 protocol, was developed as a revision of HTTP 1.0 and after 19 years it is still used today for all HTTP requests.

Over the years there are have been some slight revisions to HTTP/1.1. In 1999, introduced five new methods, OPTIONS, PUT, TRACE, CONNECT, and DELETE. And then in March 2010, introduced the PATCH method. As of today the current version defines nine different request methods.

In HTTP/0.9 and 1.0 the connection was closed after a single request. In HTTP/1.1 persisted connections (more than one request/response on the same HTTP connection) were introduced, which dramatically reduced latency. Other improvements such as caching, better compression support, and Cross-Origin Resource Sharing were also added.

If there is a problem with an HTTP request there is a list of status codes which inform your browser so that you can better troubleshoot what the problem might be. The way the user-agent handles the response depends upon the code and the response header fields. For example, a 404 Not Found error means the the content either does not exist or has been moved. Or another common example is a 502 Bad Gateway error which could mean that the domain name is not resolving to the correct IP or it does not resolve to any IP.

What is HTTPS?

HTTPS stands for Hypertext Transfer Protocol Secure (also referred to as HTTP over TLS or HTTP over SSL). When you enter https:// in your address bar in front of the domain, it tells the browser to connect over HTTPS. Generally sites running over HTTPS will have a redirect in place so even if you type in http:// it will redirect to deliver over a secured connection. HTTPS also uses TCP (Transmission Control Protocol) to send and receive data packets, but it does so over port 443, within a connection encrypted by Transport Layer Security (TLS).

As of April 2016, 41.7% of the Internet’s 141,160 most popular websites have a secure implementation of HTTPS.

Remember Nestcape? Well HTTPS was actually created by Netscape Communications back in 1994 to use in its Netscape Navigator web browser. HTTPS originally used the SSL protocol which eventually evolved into TLS, the current version defined in May 2000. That is why you might hear the terms SSl and TLS thrown around quite loosely.

HTTPS transmits its data security using an encrypted connection. Basically it uses a public key which is then decrypted on the recipient side. The public key is deployed on the server, and included in what you know as an SSL certificate.The certificates are cryptographically signed by a certificate authority (CA), and each browser has a list of CAs it implicitly trusts. Any certificate signed by a CA in the trusted list is given a green padlock lock in the browser’s address bar, because it’s proven to be “trusted” and belongs to that domain. Companies like Let’s Encrypt have now made the process of issuing SSL certificates free.

We wrote a post a while back on why you should be establishing SSL TRUST for your business. According to a Global Sign Survey, 84% of shoppers abandon a purchase if data was sent over an unsecured connection and 28.9% look for the green address bar. Never enter your credit card details on websites that run over HTTP. The main purpose of using HTTPS is for security and privacy reasons. When the data is encrypted this means nothing is passing in plain text. A lot of people might question whether they need to bother with HTTPS on smaller sites, like a blog, but remember even your login page should be encrypted.

SPDY

SPDY (pronounced SPeeDY) is a network protocol that was designed by Google with the aim to make the web faster. It was originally announced back in 2009. SPDY requires the use of SSL/TLS (with TLS extension ALPN) for security but it also supports operation over plain TCP.

The three main benefits were:

1. Allows client and server to compress request and response headers, which reduces bandwidth usage when the similar headers (e.g. X-Cache) are sent over and over again for multiple requests.
2. Allows multiple requests over a single connection and therefore saving on round trips between client and server. Further, preventing low priority assets from delaying higher priority requests.
3. Enables the server to proactively push assets to the client that it knows the client will require (e.g. CSS and images) without waiting for the client to request them.

What is the difference between HTTP and HTTPS?

Below are some of the main differences between the HTTP and HTTPS protocols, in no particular order.

1. HTTP URL in your browser’s address bar is http:// and the HTTPS URL is https://.
2. HTTP is unsecured while HTTPS is secured.
3. HTTP sends data over port 80 while HTTPS uses port 443.
4. HTTP operates at application layer, while HTTPS operates at transport layer.
5. No SSL certificates are required for HTTP, with HTTPS it is required that you have an SSL certificate and it is signed by a CA.
6. HTTP doesn’t require domain validation, where as HTTPS requires at least domain validation and certain certificates even require legal document validation.
7. No encryption in HTTP, with HTTPS the data is encrypted before sending.

Conclusively

We highly encourage you to think about switching over to HTTPS. The TLS negotiation and CPU overhead are now very negligible and in a lot of tests we have seen performance improvements when people make the switch from HTTP to HTTPS, as long as they are running over HTTP/2. Before hosting your site you should ensure that your site runs on https with SSL Certificate for a better protection on the internet.

Please drop your Comment.