What does HTTPS add to HTTP?
Options
- Only faster page loads, mostly on slow mobile networks
- Encryption and server identity checks via TLS, so data is safe (Correct option)
- A different data format for the requests and the responses
- Automatic login for the visitors that return to the site
Answer
Encryption and server identity verification via TLS, so data cannot be read or changed in transit
Why
With plain HTTP, anyone on the same Wi-Fi or network path can read and modify the traffic, including passwords.
HTTPS wraps HTTP in TLS: the data is encrypted, protected against tampering, and the certificate proves you are talking to the real server.
Today every site and API should use HTTPS.
Remember
HTTPS = HTTP + encryption + identity check.