HTTPS is plain HTTP wrapped inside an encrypted TLS connection. HTTP sends everything as readable text over the wire. HTTPS scrambles it, so anyone in between sees only noise.
The TLS layer does three jobs. It hides the content from eavesdroppers. It proves you reached the real server, not an impostor. It detects any tampering with the bytes in transit.
This matters because networks are full of untrusted hops, such as coffee-shop WiFi, ISPs and proxies. Without HTTPS, passwords and cookies travel in the clear. Browsers now mark plain HTTP pages as not secure, so HTTPS is the default. That is why login pages and payment forms always use it.
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
With HTTPS on, what can someone watching the network still learn?The server IP, usually the hostname through DNS or SNI, and traffic sizes and timing. The path, query, headers and body stay encrypted.
Your site is HTTPS, but a user types the plain http:// address. What can go wrong, and how do you stop it?The first request goes out in the clear, so an attacker can keep the user on HTTP. Name HSTS, preloading for first visits, and Secure cookies.
HTTPS is plain HTTP sent inside an encrypted TLS connection. The requests and responses are the same, but nobody along the path can read them.
With plain HTTP, everything crosses the wire as readable text, so any hop in between, like public WiFi, your ISP or a proxy, can see passwords and cookies.
TLS does three jobs: it hides the content, it proves you reached the real server and not an impostor, and it detects any change to the bytes in transit.
That's why browsers now mark plain HTTP pages as not secure, and why login and payment pages always use HTTPS. It's the default now.
One limit, though. HTTPS only protects data while it travels. A phishing site can get a valid certificate too, so the padlock proves which domain you reached, not that it's honest.
Weak answers to avoid
Says HTTPS just means encryptedEncryption is one of three jobs. Without checking the server's identity you could encrypt straight to an impostor. Name authentication and tamper detection too.
Treats HTTPS as a different protocol from HTTPMethods, headers and status codes are identical. HTTPS is the same HTTP carried inside TLS. Getting that layering wrong is a red flag.
Thinks the padlock means the site is safeHTTPS proves the domain and protects data in transit. It says nothing about whether the site is honest or keeps your data safe once it arrives.
Says HTTPS is only needed on login pagesCookies ride on every request, and an attacker can alter any plain HTTP page in transit, scripts included. HTTPS everywhere is the default for that reason.
Interview lens
Likely follow-ups, what you can say, and the weak answers to avoid.
