SEO check

HTTPS Encryption: How It Works and How to Check It

What HTTPS encryption is, what it hides, how our free report tests your certificate and how to turn it on.

Check my website Jump to the fix

Free to use 6 min read Updated Oct 2026

HTTPS encryption in one minute

Quick answer: HTTPS encryption is ordinary HTTP carried inside a TLS connection, so the page, form data, cookies and URL path are scrambled between browser and server. Our report checks that your certificate is trusted, matches your host name, answers on port 443 and has a day or more left.

  • Pass: a trusted, unexpired certificate that matches the host name and answers on port 443.
  • Fail: an expired, self-signed or mismatched certificate, or no HTTPS answer.
  • Fix: install a free certificate, redirect HTTP to HTTPS and automate renewal. HTTPS protects data in transit, not the site from hacking or malware.

Check my site free

What is HTTPS encryption?

HTTPS, short for Hypertext Transfer Protocol Secure, is HTTP over TLS: the same requests and responses, carried through an encrypted connection on port 443. Browsers show a padlock or similar secure connection icon when it works. Encryption turns readable text into ciphertext, and Transport Layer Security (TLS) adds authentication, since a certificate authority vouches for the server, and integrity, since tampering is detected. HTTPS is not a different language; it is HTTP inside a locked envelope.

SSL, short for Secure Sockets Layer, is the old name. RFC 8996 retired TLS 1.0 and 1.1 in 2021, leaving TLS 1.2 and 1.3. An SSL certificate is the same X.509 file as a TLS certificate.

How HTTPS encryption works

The TLS handshake sets up the channel before any page content moves. These steps follow TLS 1.2, which TLS 1.3 compresses.

  1. Hello. The browser lists the TLS versions and ciphers it supports and names its host through Server Name Indication (SNI).
  2. Certificate. The server picks a version and cipher and replies with its certificate chain. The browser checks the root, name and dates.
  3. Key exchange. Both sides run an ephemeral Diffie-Hellman exchange (ECDHE) to agree a secret without sending it. TLS 1.3, defined in RFC 8446, needs one round trip.
  4. Session keys. Symmetric session keys derived from that secret drive a cipher such as AES-GCM or ChaCha20-Poly1305.
  5. Data. Requests and responses travel as encrypted records, and forward secrecy protects old traffic if the server key later leaks.

Asymmetric cryptography, using a public key in the certificate and a private key on the server, proves identity and helps agree the secret. Fast symmetric encryption then carries the pages. The MDN guide to TLS covers the protocol side.

What HTTPS encrypts and what it leaves visible

People often ask whether HTTPS hides the URL. It hides the path and query string but not the host name.

Part of the visitVisible on the network?Why
URL path, query string, headers, cookies and form fieldsHiddenSent inside the encrypted request.
Domain nameVisibleShown by DNS and SNI, unless encrypted DNS or Encrypted Client Hello is used.
Server IP, port, size and timingVisibleRouters need the address, and packet sizes hint at content.

An ISP sees which domain you visited, not which page, while plain HTTP on port 80 is readable by anyone on the path. HTTPS covers data in transit only and never proves a site is trustworthy.

Why HTTPS encryption matters for SEO and trust

Google announced HTTPS as a ranking signal in 2014 and called it very lightweight, so enable it for trust, not rankings.

Reality check: Chrome and Firefox label plain HTTP pages not secure, and Chrome has announced a prompt before first visits to public HTTP sites.

PCI DSS expects card data to be encrypted across public networks, and privacy laws such as GDPR expect logins and personal data to be protected in transit. A click from an HTTPS page to an HTTP site carries no referrer, so analytics shows direct traffic. Browsers speak HTTP/2 only over HTTPS, so you cannot enable HTTP/2 without a certificate, and why HTTPS matters notes that geolocation needs it too. See SSL certificates and SEO for ranking.

How SEO Site Checker tests HTTPS encryption

The rule: in our free SEO report, the SSL Checker and HTTPS Test card opens port 443 of the tested host with a 3 second limit and completes a verified handshake, so the chain must be trusted and the host name must match. It then reads the TLS version and expiry in whole days, feeding the Secured badge. It does not grade ciphers, set a minimum TLS version or test the redirect.

What a pass means in the report

The card turns green and prints the protocol, for example TLSv1.3, and the expiry date. The check always uses port 443, so a site typed as http:// can still pass while a separate https:// item fails. The HSTS check and mixed content test are separate cards.

What a fail means in the report

The card turns red and the overview shows Not Secured. Usual causes are no answer on port 443 within 3 seconds, an untrusted, self-signed or incomplete chain, a name mismatch, an expired certificate, or under a full day left. The message is generic, so the browser warning or openssl output tells you which.

Run the report on my site

How to check HTTPS encryption on any website

  1. Browser. Click the site information icon beside the address bar and view the certificate: issuer, expiry and host name.
  2. Report. Read the SSL Checker and HTTPS Test card under Server and Security.
  3. Command line. Run the openssl command below, then the HTTPS curl request, which should return a normal response without certificate errors.
  4. Redirect. Open the http:// address and confirm one 301 reaches https://.
Text
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com </dev/null
curl -I https://example.com
curl -I http://example.com

In the openssl output look for "Verify return code: 0 (ok)". The -verify_hostname flag catches a wrong name (code 62) but needs OpenSSL 1.1 or later, which some macOS LibreSSL builds lack. The HTTP request should show a 301. See also our SSL checker and HTTPS test tools guide.

How to turn on HTTPS encryption for your site

Get and install a certificate

  1. Get a certificate. Many hosts include a free one, or follow Let's Encrypt getting started, run by the Internet Security Research Group, with an ACME client such as Certbot.
  2. Install the full chain. Cover the bare domain and www and turn on auto renewal, because certificate lifetimes are shrinking.
Text
sudo certbot --nginx -d example.com -d www.example.com

The hosting checker names your host. A CAA record can stop an authority issuing, and the DNS record lookup shows what your domain publishes.

Redirect and clean up

  1. Redirect. Send every http:// request to https:// with one 301.
  2. Clean up. Fix hard-coded http:// files causing mixed content, then update canonicals, sitemap and links.
  3. Harden. Consider HTTP Strict Transport Security, then rerun the report.
  • WordPress. Set both the WordPress Address and Site Address to https.
  • Shopify, Wix and Squarespace. Certificates are automatic once the domain is connected.
  • Apache HTTP Server and Nginx. Use the full chain file, listen on 443 and keep one 301 from port 80.
  • Cloudflare. Choose Full (strict) mode so the origin hop is verified.

Common HTTPS encryption mistakes

  • Silent renewal failure. A broken timer, or a DNS or firewall change blocking validation, lets the certificate expire (NET::ERR_CERT_DATE_INVALID).
  • Wrong host name. A certificate for example.com skips www, and a wildcard certificate covers one level only. Chrome reports NET::ERR_CERT_COMMON_NAME_INVALID.
  • Missing intermediate. It can look fine in one browser yet fail elsewhere, so install the full chain.
  • Self-signed leftovers. A test certificate left live gives the same error.
  • Port 443 closed. A firewall opening only port 80 gives a red card though the site loads over HTTP.
  • Not caught here. A missing redirect and old TLS versions pass but deserve a fix. The technical SEO checklist covers both.

How to Fix

The short version, the same steps you see when you click How to Fix in your report.

Why this fails: the report could not finish a trusted TLS handshake on port 443 within 3 seconds. The certificate is missing, expired, untrusted or issued for a different name, or the port is closed.

How to fix it:

  1. Find the cause. Open your site in a browser and read the certificate warning, or run the openssl command below and read the verify return code it prints.
  2. Match the message to the usual suspects: expired, wrong host name, missing intermediate, self-signed, or port 443 closed.
  3. Get a free certificate from your host, or follow the Let's Encrypt getting started guide with Certbot.
  4. Install the full chain and cover both the bare domain and www.
  5. Open port 443 in the server firewall and switch on automatic renewal.
  6. Add one 301 redirect from http:// to https://. The Nginx sample below shows it.
  7. Test and reload. On Nginx run nginx -t, then reload the service; on Apache run apachectl configtest first; on a managed host the panel does this for you.
Text
openssl s_client -connect example.com:443 -servername example.com -verify_hostname example.com </dev/null
curl -I https://example.com

A minimal Nginx setup looks like this, with paths changed to your own files:

Text
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}
server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /etc/ssl/example.com/fullchain.pem;
    ssl_certificate_key /etc/ssl/example.com/privkey.pem;
}
  • WordPress: set both the WordPress and Site address URLs to https.
  • Shopify, Wix, Squarespace: certificates are automatic, so check that your domain is connected.
  • cPanel: run AutoSSL for the domain.
  • Apache: set SSLCertificateFile and SSLCertificateKeyFile in a virtual host on port 443, and add a Redirect permanent rule in the port 80 host.
  • Cloudflare: choose Full (strict) so the connection from Cloudflare to your server is encrypted and verified too. Flexible leaves that last hop unencrypted and can hide a missing origin certificate.

Re-test: run the openssl command again and look for "Verify return code: 0 (ok)" with TLSv1.2 or TLSv1.3. The -verify_hostname flag makes a wrong host name show as code 62. Then run our free report again to confirm the card turns green.

Re-test my website

Frequently Asked Questions

What is HTTPS encryption?
HTTPS encryption is HTTP sent through a TLS connection that scrambles data between browser and server. The certificate proves the server's identity, and the exchange runs on port 443, so a network observer sees only ciphertext.
Does HTTPS encrypt the URL?
It encrypts the path and query string, because they sit inside the encrypted request, but not the domain name, which shows in the DNS lookup and SNI. History, server logs and referrers can also expose full URLs.
What type of encryption does HTTPS use?
HTTPS uses both kinds. Asymmetric cryptography proves identity and agrees a shared key, then a symmetric cipher such as AES-GCM or ChaCha20-Poly1305 encrypts the data. The versions in use are TLS 1.2 and TLS 1.3.
Is HTTPS encryption enough to keep a website secure?
No. It protects data in transit only, so it does not stop weak passwords, outdated plugins, injection bugs or malware, and phishing sites can hold valid certificates too. Treat HTTPS as one layer of security.
Can HTTPS encryption be broken?
No practical break of current TLS 1.2 or TLS 1.3 with strong ciphers is publicly known. Real failures come from old protocol versions, misconfiguration, stolen private keys, mis-issued certificates or malware on the visitor's device.
Does HTTPS improve SEO rankings?
Slightly. Google announced HTTPS as a very lightweight ranking signal in 2014, so expect a small effect at most. The bigger wins are visitor trust, no 'not secure' label, intact referrer data and HTTP/2.
How do I get HTTPS encryption on my website?
Get a free certificate from your host or Let's Encrypt, install it with the full chain, redirect HTTP to HTTPS, fix mixed content and switch on auto renewal. The steps above cover each part in detail.
Can my internet provider see what I do on HTTPS sites?
Your provider sees which domain you connect to and roughly how much data moves, but not pages, searches or form values. A VPN shifts that visibility to the VPN provider, so HTTPS alone is not anonymity.

See how your site scores right now

Paste your address into the free report, then use the How to Fix button on anything that needs work.

Check my website Browse all SEO checks
Free to use. Results in under a minute for most sites.