HTTP vs HTTPS: why that padlock matters

What is HTTP?

HTTP stands for HyperText Transfer Protocol. It's the language your browser uses to talk to a website. When you request a page, your browser sends an HTTP request to the server and gets the content back.

The problem? HTTP sends everything as plain text. Anyone listening in on the network, think of public wifi in a coffee shop, can see what you're sending. Passwords, form data, payment details: everything is out in the open.

What is HTTPS?

HTTPS is HTTP with an S, which stands for Secure. It uses an SSL/TLS certificate to encrypt the connection between browser and server.

Picture it like this:

HTTP = a postcard that anyone along the route can read
HTTPS = a sealed letter in a safe that only the recipient can open

The nice part: nothing visually changes for the visitor. The URL starts with https:// instead of http://, and a padlock appears in the address bar. That's it. In the background, all communication is encrypted.

Why does HTTPS matter?

1. Security

All data between visitor and website is encrypted:

Login credentials
Contact forms
Payment details
Cookies and session tokens
Personal information

Without HTTPS, attackers on the same network can carry out a man-in-the-middle attack: they capture the traffic, read it, or even inject their own content into your page (think fake ads or malware).

2. Visitor trust

Visitors immediately see the padlock in the address bar. Without HTTPS, Chrome has been prominently showing "Not secure" next to your domain name since 2018, and even in red on form pages. Research shows 84% of users abandon a purchase on a site that says "Not secure".

3. SEO ranking

Google announced back in 2014 that HTTPS is a ranking factor. Websites with HTTPS score better in search results than sites without. It's one of the foundations of technical SEO. Read more in SEO basics: how to get found on Google.

On top of that, without HTTPS you can't use modern web features like HTTP/2, service workers or geolocation, which only work over secure connections. That has a direct effect on your Core Web Vitals and therefore on your ranking.

4. Legally required (GDPR)

Under GDPR you're required to protect personal data. Got a contact form, newsletter signup or customer portal without HTTPS? Then you don't meet the law and you run both legal and reputational risk.

How do you recognise HTTPS?

Look at the address bar of your browser:

Indicator	Meaning
Padlock + `https://`	Secure, encrypted
"Not secure" + `http://`	No encryption
Red warning screen	Invalid or expired certificate

What if my website is still on HTTP?

Time to switch over. Here's what's involved:

Request an SSL certificate: free via Let's Encrypt or through your hosting provider
Install the certificate on your server
Set up an HTTP to HTTPS redirect (301 redirect, so permanent)
Fix mixed content: all internal links, images and scripts also need to load via https://
Update sitemap and robots.txt with the new HTTPS URLs
Re-verify Search Console for the HTTPS version
Check canonical tags so Google indexes the right version

It sounds like a lot, but it's a one-time job. And the SEO boost pays for itself quickly.

At Friday Webs, SSL is included as standard in every package. You don't have to think about it. All sites launch with HTTPS from day one, with automatic certificate renewal.

Summary

	HTTP	HTTPS
Encryption	No	Yes
Padlock in browser	No	Yes
SEO benefit	No	Yes
Safe for forms	No	Yes
Visitor trust	Low	High
GDPR compliant	No	Yes
HTTP/2 possible	No	Yes

In short: HTTPS is not a luxury, it's a must-have. Every modern website should use HTTPS, full stop. If your site doesn't have HTTPS yet, that's the first step towards better security, better SEO and more trust from your visitors.

Not sure whether everything is set up correctly on your end? Take the free SEO check and we'll show you straight away whether your site is secure and properly configured.