HTTP and HTTPS
The request–response protocol that powers the World Wide Web, and its encrypted variant secured by TLS.
HTTP (Hypertext Transfer Protocol) is the application-layer protocol of the World Wide Web. A client — typically a browser — sends a request to a server, and the server sends back a response. The protocol is deliberately simple: a request contains a method, a path, and headers, and a response contains a status code, headers, and usually a body.
The request methods cover the common operations: GET retrieves a resource, POST submits data, PUT and DELETE modify or remove resources, HEAD asks for headers only, and OPTIONS describes what a server supports. Responses are classified by their status code:
| Class | Meaning | Examples |
|---|---|---|
| 2xx | success | 200 OK, 204 No Content |
| 3xx | redirection | 301 Moved Permanently, 304 Not Modified |
| 4xx | client error | 400 Bad Request, 404 Not Found, 429 Too Many Requests |
| 5xx | server error | 500 Internal Server Error, 503 Service Unavailable |
Headers carry metadata: Content-Type describes the body format, Cache-Control governs caching, and cookies are transmitted through the Cookie and Set-Cookie headers. HTTP is stateless — each request is independent — so state such as login sessions is layered on top with cookies or tokens.
HTTPS is HTTP layered on Transport Layer Security (TLS). Before application data flows, the client and server perform a TLS handshake in which they negotiate a cipher, authenticate the server using a certificate signed by a trusted certificate authority, and derive session keys. All subsequent bytes — request, response, and headers — are encrypted and integrity-protected.
Encryption matters because an unencrypted HTTP request can be read or modified by anyone on the path between client and server: a Wi-Fi eavesdropper, a malicious router, or an ISP. HTTPS prevents passive reading, tampering, and impersonation, which is why virtually the entire web now uses it, enforced by mechanisms such as HSTS and browser warnings for plain HTTP. HTTP runs over TCP (or QUIC in HTTP/3), and resolving the hostname is a job for DNS.