{"id":16207,"date":"2023-03-10T12:20:00","date_gmt":"2023-03-10T17:20:00","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=16207"},"modified":"2023-03-31T12:14:52","modified_gmt":"2023-03-31T16:14:52","slug":"is-https-secure-a-look-at-how-secure-https-is","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/is-https-secure-a-look-at-how-secure-https-is\/","title":{"rendered":"Is HTTPS Secure? A Look at How Secure HTTPS Is"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-from-securing-banking-websites-to-protecting-data-during-your-online-purchases-the-https-http-secure-protocol-can-be-found-all-over-the-internet\">From securing banking websites to protecting data during your online purchases, the HTTPS (HTTP secure) protocol can be found all over the internet&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When you visit your favorite website (say, Amazon or GitHub), you connect to that site via a secure, encrypted connection. This secure connection triggers a little padlock security icon to appear next to your browser\u2019s web address bar.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But is HTTPS secure? If you\u2019re looking for a quick answer, it\u2019s yes. But that positive response is only true so long as:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTPS is properly implemented, and<\/li>\n\n\n\n<li>the mechanisms that enable HTTPS are protected.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to learn more about how secure HTTPS is in a more technical sense, then we\u2019ve got you covered, so keep reading.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-is-https-secure-and-if-so-how-secure-is-https\">Is HTTPS Secure? And, If So, How Secure Is HTTPS?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When it comes to data security, one of the most trusted and heavily relied upon internet protocols is the <strong>hypertext transfer protocol secure<\/strong>. (Note: <em>HTTP secure<\/em> should not be confused with <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc2660\"><em>secure HTTP<\/em> or <em>S-HTTP<\/em><\/a>, which the Internet Engineering Task Force [IETF] listed as an experimental protocol in <a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc2660\">RFC 2660<\/a>.) HTTPS is a way to securely transmit data between two parties or entities (e.g., browsers to web servers in traditional SSL\/TLS web sessions). It relies on a mix of cryptographic techniques and tools.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But just how secure is HTTPS? Well, it\u2019s the <em>de facto<\/em> standard protocol for secure communication on the world wide web \u2014 it\u2019s been chosen as the most secure option by the stakeholders that help run the web. The U.S. federal government requires all <a href=\"https:\/\/https.cio.gov\/\">federal websites and services to be provided via HTTPS<\/a> connections. So, that should say something about its security. And according to <a href=\"https:\/\/cdn.httparchive.org\/almanac\/ebooks\/web_almanac_2022_en.pdf\">HTTP Archive\u2019s 2022 Web Almanac report<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>94% of total website connection requests on desktop devices and 93% on mobile devices use HTTPS.<\/li>\n\n\n\n<li>89.3% of website home pages are served up on desktop devices via HTTPS; the same can be said for 85.5% of mobile site home pages.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Why the difference between the total request percentages and the percentages of home pages being served via HTTPS? According to HTTP Archive, this has to do with the requests largely using third-party services that have higher HTTPS adoption rates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s a quick chart to show the increase in HTTPS usage over the past reported year:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1025\" height=\"615\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https.png\" alt=\"A bar chart graphic that shows the growing number of home pages delivered via HTTPS connections on mobile and desktop devices\" class=\"wp-image-16208\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https.png 1025w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https-300x180.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https-768x461.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https-698x419.png 698w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https-400x240.png 400w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/home-pages-served-via-https-460x276.png 460w\" sizes=\"auto, (max-width: 1025px) 100vw, 1025px\" \/><figcaption class=\"wp-element-caption\"><em>Image caption: A bar chart that illustrates the increase in home pages being served via desktop and mobile devices from 2021 to 2022.<\/em> <em>The data used in this bar chart comes from the HTTP Archive\u2019s 2022 Web Almanac Report.<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Okay, so now that we know HTTPS is secure overall, let\u2019s actually talk about what HTTPS is.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is HTTPS? HTTPS = HTTP + TLS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As we mentioned earlier, HTTPS is an internet protocol. More specifically, it\u2019s the successor of HTTP, which is the hypertext transfer protocol. Unlike its HTTP predecessor, however, it\u2019s a <em>secure<\/em> protocol. This is because HTTPS, also known as <em>HTTP over TLS,<\/em> relies on the transport layer security protocol to transmit HTTP data for requests and responses.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It used to be <em>HTTP over SSL<\/em>, which is why you\u2019ll sometimes see SSL\/TLS used interchangeably, even though they\u2019re technically different protocols at the granular level. <a href=\"https:\/\/www.thesslstore.com\/blog\/the-real-truth-about-tls-vs-ssl-the-difference-may-surprise-you\/\">TLS is the successor of SSL<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, to better understand what HTTPS is and how secure it is, you first need to understand what it isn\u2019t. Let\u2019s quickly compare the two protocols to get an understanding of how they differ.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>&nbsp;<\/td><td><strong>HTTP<\/strong><\/td><td><strong>HTTPS<\/strong> <strong>(HTTP Secure)<\/strong><\/td><\/tr><tr><td><strong>What It Stands For<\/strong><\/td><td>Hypertext transfer protocol<\/td><td>Hypertext transfer protocol secure &nbsp;<\/td><\/tr><tr><td><strong>How Data Transmits<\/strong><\/td><td>Data transmits in plaintext format via the internet<\/td><td>Data transmits via a secure, encrypted connection on the internet &nbsp;<\/td><\/tr><tr><td><strong>Is HTTPS Secure?<\/strong><\/td><td>No, it\u2019s an insecure protocol<\/td><td>Yes, so long as it\u2019s using an up-to-date version of TLS (TLS 1.2 or later) and proper key management best practices are followed &nbsp;<\/td><\/tr><tr><td><strong>What It Does<\/strong><\/td><td>It transmits data in plaintext format. It doesn\u2019t provide any mechanisms to protect data security, integrity, or ensure authentication &nbsp;<\/td><td>Provides authentication, data confidentiality, and integrity protection to transmit data securely<\/td><\/tr><tr><td><strong>What It Requires<\/strong><\/td><td>An internet connection<\/td><td>An internet connection and an SSL\/TLS digital certificate issued by a publicly trusted certificate authority &nbsp;<\/td><\/tr><tr><td><strong>Default Port<\/strong><\/td><td>Commonly uses port 80<\/td><td>Commonly uses port 443<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">To learn more about <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-https-what-https-stands-for\/\">what HTTPS is<\/a>, be sure to check out our other article on the topic.<\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12753\"><\/span>\n\n\n\n<h2 class=\"wp-block-heading\">3 Reasons Why HTTPS Is Secure<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Okay. Simply saying that HTTPS is secure isn\u2019t enough. Let\u2019s go over the reasons why HTTPS is considered secure by reviewing what it does\u2026<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. HTTPS Uses Encryption to Keep Data Confidential<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">At its core, HTTPS is all about transferring data securely via insecure channels (i.e., the internet). <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-encryption\/\">Encryption<\/a> takes readable data (plaintext) and converts it into something undecipherable (called ciphertext) using a cryptographic key. It\u2019s then decrypted on the other party\u2019s end using a corresponding secret key. This protects data from unintended eyes as it transmits from one party to the other.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The process looks like this if you picture a conversation between two users:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"840\" height=\"1016\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/https-protects-data-confidentiality2.png\" alt=\"A two-part illustration that shows a basic idea of how HTTPS protects data confidentiality between two parties. The top graphic shows what the parties see in their encrypted conversation. The second graphic shows what an attacker sees (i.e., a bunch of gibberish ciphertext) when they don't have the necessary decryption key.\" class=\"wp-image-16209\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/https-protects-data-confidentiality2.png 840w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/https-protects-data-confidentiality2-248x300.png 248w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/https-protects-data-confidentiality2-768x929.png 768w\" sizes=\"auto, (max-width: 840px) 100vw, 840px\" \/><figcaption class=\"wp-element-caption\"><em>Image caption: A two-part illustration to answer the question \u201cis HTTPS secure?\u201d It shows what two participants see in an encrypted communication channel (top half) and what outsiders who don\u2019t have the necessary cryptographic keys sees (bottom half). Translation: All they see is a whole bunch of gibberish because HTTPS protects confidentiality when implemented appropriately.<\/em><\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">To better understand HTTP secure, let\u2019s put ourselves in the shoes of a hypothetical website user. Imagine that you want to log in to your favorite website. After you enter your username and password, you hit enter. On a secure website, your plaintext data is converted into something that no one can read without the use of a special secret key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This key, which only your intended recipient has access to, enables the recipient to decrypt your data and return it to a readable format. This means that anyone who intercepts your data in transit (i.e., as it moves from your browser to the website\u2019s server) will be able to see the gibberish but won\u2019t be able to make any sense of it. Pretty cool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But encryption on its own isn\u2019t enough to ensure that a site you visit is safe. <em>Secure<\/em>, yes, but not <em>safe<\/em>. You need additional layers of security to help with that.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. HTTPS Authenticates Who You\u2019re Communicating With<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If it walks like a duck and quacks like a duck, then it\u2019s probably a duck, right? Not always. Just because someone claims to be from the FBI over the phone doesn\u2019t mean they\u2019re necessarily the FBI; they could be a cybercriminal trying to hustle you. This is a common <a href=\"https:\/\/www.thesslstore.com\/blog\/10-types-of-phishing-attacks-and-phishing-scams\/\">phishing scam<\/a> tactic: they\u2019ll pretend to be someone in a position of authority to trick, manipulate or coerce you into doing something.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To trust that it\u2019s really the FBI, you\u2019ll need to hang up and call back the supposed representative using the FBI\u2019s official agency phone number. Never trust any information given to you by an unknown caller \u2014 this includes the phone number to call them back at. Chances are, the person who called isn\u2019t a real agent; they\u2019re a cybercriminal looking for an easy payday. Likewise, just because a website looks like your favorite website doesn\u2019t mean it is: it could be a phishing or otherwise malicious website that\u2019s designed to look legitimate to lull you into a false sense of security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s continue with the hypothetical example of being a website user. Imagine that you type <em>amazon.com<\/em> into your browser but accidentally misspell it (or maybe <a href=\"https:\/\/www.thesslstore.com\/blog\/dns-poisoning-attacks-a-guide-for-website-admins\/\">DNS poisoning routes you to the wrong server<\/a>). Instead, you land on a look-alike site with a slightly different URL but don\u2019t realize it. You make your purchase, not realizing anything is wrong. A few weeks later, you\u2019re going through your credit card statement and see a bunch of unknown charges. Turns out, a cybercriminal stole your personal information and credit card data through that mistyped website. Now, they\u2019re going on daily shopping sprees and are having a positively fabulous time \u2014 all on your dime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is where website authentication comes into play. Authentication is a way to verify that the website you\u2019re visiting is legitimate because a publicly trusted third party has checked it out and given it a stamp of approval in the form of an SSL\/TLS certificate. By issuing this small digital file, the trusted third party (known as a certificate authority) attests that the organization in control of the domain is authentic by checking official records and resources.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Choose the Right Validation For Your Data Security Needs<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">These digital certificates are available in a few validation levels:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.thesslstore.com\/products\/cheap-ssl-certificates.aspx\">domain validation<\/a> validates your domain only,<\/li>\n\n\n\n<li><a href=\"https:\/\/www.thesslstore.com\/products\/high-assurance-certificates.aspx\">organization validation<\/a> offers domain + basic business validation, and<\/li>\n\n\n\n<li><a href=\"https:\/\/www.thesslstore.com\/extended-validation-ssl-certificates.aspx\">extended validation<\/a> which offers domain + the most in-depth validation of the organization.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s best to use organization validation certificates as a minimum if you\u2019re collecting any type of customer information to provide users with a way to verify your authenticity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But authenticating the website\u2019s legitimacy isn\u2019t enough, either; you need other another way to know that the data sent between your browser and the web server is protected from unauthorized alterations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. HTTPS Ensures Data Isn\u2019t Tampered With (i.e., Offers Data Integrity Protection)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The concept of data integrity is that the data you send or receive via a network isn\u2019t modified, deleted, or otherwise altered from the time one party sent it to when it was received by the second party. Why is this important? Because if someone alters key pieces of information behind the scenes, if you don\u2019t have data integrity checks in place, neither you nor the other party you\u2019re communicating with would realize something\u2019s amiss until it\u2019s too late. &nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Think of it like the data equivalent of a tamper-proof container or product packaging; it\u2019s here to ensure that no one has messed with your product between the time it left the manufacturer to when you bought it. Yup, that\u2019s it in a nutshell. Now, let\u2019s apply this to the hypothetical website user scenario.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine you\u2019re a bank customer and want to transfer some money to a friend using the bank website. You set up the transfer, but as you hit submit, you don\u2019t realize that someone has positioned themselves in the middle of your connection and all of your data transmissions flow through them. (This is known as a <a href=\"https:\/\/www.thesslstore.com\/blog\/man-in-the-middle-attack\/\">man-in-the-middle attack<\/a>, or MitM attack.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What this means is that without certain security measures in place, they can alter critical information to suit their purposes. For example, they can:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Change the bank account you\u2019re sending the money to, to one they control,<\/li>\n\n\n\n<li>Upgrade the payment to a higher number (e.g., turning a $100 transfer into a $1,000 payment or more), and<\/li>\n\n\n\n<li>Remove or change other critical information from the data you transmit in the session.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Using HTTPS Matters (And Why You Should Use It)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To reiterate, HTTPS is secure and HTTP is not. If your website can\u2019t ensure confidentiality, authentication, or integrity, it\u2019s definitely a problem, regardless of whether you\u2019re a website user or a website owner. It\u2019s just bad news all the way around.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Without verifiable identity, you don\u2019t know who the other party is, let alone if they\u2019re trustworthy.<\/strong> If you receive data from an unknown party, how do you know it\u2019s legitimate? Or, if you send sensitive data to an unverified party, how do you know your data is safe, and you haven\u2019t just handed it over to a bad guy? You can\u2019t if you don\u2019t have a way to verify they are who they say they are.<\/li>\n\n\n\n<li><strong>Without data encryption, you can\u2019t know if your sensitive info will stay confidential.<\/strong> If you\u2019re sending data across an insecure network like the internet, you shouldn\u2019t expect privacy or confidentiality. It\u2019s like getting naked in the middle of the street: someone\u2019s inevitably going to see your \u201cprivate assets\u201d (if you know what I mean) because it\u2019s likely that at least one person will want to take a quick peek.<\/li>\n\n\n\n<li><strong>Without data integrity, you have no way of knowing whether critical data has been changed.<\/strong> When exchanging data with another party, you need to know that no one has been messing with it in transit. Otherwise, how can you or the other party trust anything that\u2019s been sent or received in the communications? You can\u2019t.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Is Your TLS Version Secure?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">But there is another important factor in play when it comes to HTTPS security. Earlier in the article, we mentioned that for HTTPS to work, you need to use a current version of the TLS protocol. The industry as a whole is slowly making its shift from TLS 1.2 to TLS 1.3. Additional data from HTTP Archive (from the same report we shared earlier) shows that 67% of home pages designed for desktop devices are served via TLS 1.3. Their research also shows that TLS 1.3 is supported by 70% of mobile website home pages.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So, it\u2019s not just about using a TLS connection for HTTP responses; it\u2019s about using a valid, up-to-date TLS protocol that\u2019s supported by browsers and servers. With this in mind, avoid using protocols older than TLS version 1.2 (TLS 1.1, TLS 1.0, or any of the SSL protocols).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To learn more about <a href=\"https:\/\/www.thesslstore.com\/blog\/how-does-https-work\/\">how HTTPS works<\/a>, be sure to check out our other blog on the topic. &nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Get HTTPS on Your Website<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To enable HTTPS on your web servers, you need something known as an SSL\/TLS certificate. This digital certificate, also known as a <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-a-website-security-certificate-and-what-does-it-do-for-your-business\/\">website security certificate<\/a>, is a small data file you install on your website\u2019s server. It\u2019s essential to <a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-pki-a-crash-course-on-public-key-infrastructure-pki\/\">public key infrastructure<\/a> and enables the use of HTTPS. In some ways, an SSL\/TLS certificate (and its corresponding cryptographic keypair) is much like a passport in that it:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Ties your organization\u2019s verified identity to the certificate and your domain (much like how a passport proves your personal identity).<\/li>\n\n\n\n<li>Is issued by a trusted third-party certificate authority (much like the U.S. Department of State issues passports).<\/li>\n\n\n\n<li>Requires secure storage of the certificate\u2019s cryptographic private key to prevent the certificate from being compromised (much like how you likely keep your passport locked up to keep it safe).<\/li>\n\n\n\n<li>Must be carefully managed to ensure you renew it before it has a chance to expire (much like how you can\u2019t fly with an expired passport, expired SSL\/TLS certificates won\u2019t do you any good, either, and result in outages).<\/li>\n<\/ul>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12653\"><\/span>\n\n\n<h2 class=\"wp-block-heading\">How to Ensure Connections Are Forged via HTTPS Automatically<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A lack of HTTPS leaves users\u2019 data at risk of compromise. To keep your website and users secure, you\u2019ll want to ensure they\u2019re using HTTPS to connect to your site. This is commonly done by setting redirect rules on your server to switch users from <em>http:\/\/<\/em> to <em>https:\/\/<\/em> automatically.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can take it a step further with &nbsp;<a href=\"https:\/\/www.thesslstore.com\/blog\/what-is-hypertext-strict-transport-security-hsts\/\">HTTP strict transport security<\/a>, or what\u2019s known more commonly as HSTS. HTTP strict transport security is a browser response header. When you have HSTS in place and a client requests an HTTP connection to your website, your server\u2019s response to the browser will include this header. This message will tell the browser to load the site using HTTPS. You can set up specific directives that inform browsers to load subsequent connections based on set parameters.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s an example of an HSTS header that says a domain (and subdomains) should only be contacted over HTTPS for 31,536,000 seconds (one year):<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Strict-Transport-Security: max-age=31536000; includeSubDomains<\/em>; preload<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But how popular is HSTS? HTTP Archive reports that 25% of mobile responses and 28% of desktop device responses include HSTS headers. We previously shared that <a href=\"https:\/\/www.thesslstore.com\/blog\/gov-domains-to-force-https-hsts-preloading-will-be-enabled-starting-sept-1\/\">new U.S. .gov domains would be required to use HSTS preloading<\/a> starting Sept. 1, 2020. Major browsers like <a href=\"https:\/\/hstspreload.org\/\">Google Chrome<\/a>, <a href=\"https:\/\/blog.mozilla.org\/security\/?s=HSTS+Preloading\">Mozilla Firefox<\/a>, and <a href=\"https:\/\/blogs.windows.com\/msedgedev\/2015\/06\/09\/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7\/\">Microsoft Edge<\/a> have their own versions of HSTS preloading lists (although many of the others are based on Google\u2019s).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Implementing an HSTS policy helps to prevent protocol downgrade attacks as well as cookie hijackings. Downgrade attacks enable bad guys to get the browser and server to switch to using older, insecure parameters for encrypting data in transit. By doing this, they can exploit vulnerabilities that enable them to intercept and decrypt your data while it\u2019s moving between the two legitimate parties.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">So, Is HTTPS Secure? Final Thoughts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Alright, it\u2019s time to wrap things up. We hope this clearly explains how HTTPS is secure and why it\u2019s the go-to protocol for secure website connections. We\u2019ve shared quite a few resources throughout this article, including links to more in-depth information on what HTTPS is and how it works.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The big takeaway here is that HTTPS is secure, so long as it\u2019s properly implemented. This means:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Using SSL\/TLS certificates issued by a trusted CA that offers at least organization-level validation<\/li>\n\n\n\n<li>Implementing HSTS to prevent downgrade attacks<\/li>\n\n\n\n<li>Carefully monitoring and managing the cryptographic certificates and keys within your digital environment<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If you have any additional thoughts to share on HTTPS security, be sure to share them in the comments below. &nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>From securing banking websites to protecting data during your online purchases, the HTTPS (HTTP secure) protocol can be found all over the internet&nbsp; When you visit your favorite website (say,&#8230;<\/p>\n","protected":false},"author":17,"featured_media":16211,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[130,16,10200],"tags":[170],"class_list":["post-16207","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-everything-encryption","category-hashing-out-cyber-security","category-monthly-digest","tag-https","post-with-tags"],"views":15654,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2023\/03\/is-https-secure-feature.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/16207","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=16207"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/16207\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/16211"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=16207"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=16207"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=16207"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}