To get it out of the way straight off, in case anyone still needs the definition: HTTP is the basic protocol through which a browser and a website exchange data; HTTPS is its encrypted counterpart — whatever you send between yourself and the site is protected against eavesdropping and tampering. That's the obligatory definition. What's more interesting is everything that has happened around it over the past few years, and where it's all heading next.
From "nice to have" to an absolute given
Just ten years ago, an SSL certificate — the technology that makes HTTPS possible — was an optional extra, something bought mainly by banks and online shops with a payment gateway. Today, things look quite different, for three reasons:
It's free and automatic. The Let's Encrypt project essentially dismantled the business model of "sell people certificates for thousands of crowns a year". Nowadays, issuing and renewing a certificate is a fully automated background process that nobody even notices. If someone is still billing you for an "SSL certificate" as a separate line item running into thousands of crowns a year, it's perfectly reasonable to ask why.
Browsers have made it non-negotiable. Chrome, Firefox, and the rest now display a "Not secure" warning to visitors on any site without HTTPS. That's not a gentle nudge — it's a red label that reliably puts people off within the first second on the page. HTTPS has therefore stopped being a technical choice and become a matter of first-impression credibility.
Search engines — and now AI assistants — treat it as a quality signal. Google has long confirmed that HTTPS is one of the factors used to rank pages. The same logic applies to the new generation of generative search engines: a site that doesn't inspire technical trust is less likely to be surfaced as a source for AI-generated answers.
Where the technology is heading next
HTTPS itself is no longer the finish line — it's simply the minimum entry ticket. Development is moving forward on at least three fronts:
- HSTS (HTTP Strict Transport Security) — a setting that tells the browser "always visit this site over HTTPS only, never try the unencrypted HTTP version", even on the very first visit. A small but important step beyond basic security.
- HTTP/3 and the QUIC protocol — a newer generation of transport protocol that also addresses how quickly a page loads on an unstable connection (typically mobile networks). In short: a faster, more reliable web even where the signal is weak.
- Certificate automation goes even further — the direction modern hosting and cloud platforms are moving in is one where administrators don't need to think about certificates at all; they renew and manage themselves, with no risk of "expiring" and suddenly taking a site offline.
What to take away from all this as a website owner
You don't need to understand the cryptography behind any of it. You just need to know this: if your website is still running on HTTP without encryption, you're losing visitors' trust in the very first seconds, ranking lower in search results, and standing less chance of being recommended by an AI assistant. And fixing it is not a costly investment — it's a standard part of any professionally built website, something every site should have today, regardless of business size.
It's a bit like seatbelts in a car — once an optional extra, now so obvious it doesn't even come up in conversation. HTTPS is exactly there now.