HTTPS is HTTP wrapped in Transport Layer Security (TLS). Every HTTPS connection begins with a TLS handshake that authenticates the server to the client (via certificate verification), optionally authenticates the client to the server, and establishes a shared encryption key. All subsequent HTTP traffic on the connection is encrypted.
The transition from HTTP to HTTPS as the default for public websites was substantially driven by Let's Encrypt (free automated certificates from 2015 onward), browser UI changes that marked plain HTTP as "not secure," and SEO pressure from Google. As of 2026, virtually all production-grade public-facing web traffic is HTTPS.
HTTPS is effectively a baseline security requirement rather than an enhancement. Any production deployment that exposes plain HTTP to the public internet should be treated as a security defect. Internal services may still run on plain HTTP, though the industry trend is toward zero-trust architectures that encrypt all traffic regardless of network location.