HTTPS
In one sentence
HTTP carried over an encrypted connection, authenticated by a certificate.
Analogy Mental model
A sealed envelope instead of a postcard. The postal worker carries it either way, and only one of them can read it.
In practice What you actually do
Get a free certificate from Let's Encrypt, or terminate TLS at a provider that issues one for you. Then force the whole site over HTTPS with a permanent redirect from HTTP, and enable HSTS once you are certain every subdomain supports it.
Where people get burned Pitfalls
The ranking effect is small and the trust effect is not: a browser warning ends the visit before the page appears, and on a checkout it ends the order.
This entry was written in English from the Chinese original, not machine-translated. Read the Chinese version →