{"id":22790,"date":"2025-10-31T13:59:44","date_gmt":"2025-10-31T06:59:44","guid":{"rendered":"https:\/\/msf.telkomuniversity.ac.id\/?p=22790"},"modified":"2025-10-31T15:50:08","modified_gmt":"2025-10-31T08:50:08","slug":"https-explained-why-the-little-lock-in-your-browser-matters","status":"publish","type":"post","link":"https:\/\/msf.telkomuniversity.ac.id\/en\/https-explained-why-the-little-lock-in-your-browser-matters\/","title":{"rendered":"HTTPS Explained: Why the Little Lock in Your Browser Matters"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Have you ever noticed the small padlock icon next to the website address in your browser? Or perhaps you\u2019ve seen the warning <em>\u201cNot Secure\u201d<\/em> when visiting certain sites?<br>Behind that simple detail lies one of the most important technologies in modern internet security \u2014 HTTPS.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine you\u2019re sending a confidential letter. You have two options: send it in a transparent envelope that anyone can read along the way, or send it in a sealed envelope that only the recipient can open.<br>That\u2019s essentially the difference between HTTP and HTTPS \u2014 and in today\u2019s digital world, choosing the right one determines whether your data stays safe or becomes a target for cybercriminals.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Is HTTPS? Understanding the Basics<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS stands for Hypertext Transfer Protocol Secure \u2014 the secure version of HTTP, the protocol used to transfer data between your browser and the websites you visit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If HTTP is like having a public conversation in an open space, HTTPS is a private discussion inside a soundproof, locked room.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Technically, HTTPS adds an encryption layer using SSL (Secure Sockets Layer) or its successor, TLS (Transport Layer Security).<br>This means all the data transmitted between your browser and the website\u2019s server is encrypted, so even if an attacker intercepts it, all they\u2019ll see are meaningless codes \u2014 not your actual information.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">HTTP vs HTTPS: The Fundamental Differences<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table class=\"has-fixed-layout\"><thead><tr><th>Feature<\/th><th>HTTP<\/th><th>HTTPS<\/th><\/tr><\/thead><tbody><tr><td>Encryption<\/td><td>None (plain text)<\/td><td>End-to-end encrypted<\/td><\/tr><tr><td>Protection<\/td><td>Vulnerable to interception<\/td><td>Secure from eavesdropping<\/td><\/tr><tr><td>Authentication<\/td><td>No identity verification<\/td><td>Server identity verified<\/td><\/tr><tr><td>Data Integrity<\/td><td>Not guaranteed<\/td><td>Fully protected from tampering<\/td><\/tr><tr><td>Default Port<\/td><td>80<\/td><td>443<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">The Real Meaning of HTTPS: Beyond Encryption<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">When we talk about the meaning of HTTPS, it\u2019s not just about encryption. HTTPS stands on three core pillars of cybersecurity:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. <strong>Confidentiality<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Encryption ensures that the data you send \u2014 passwords, credit card numbers, or private messages \u2014 cannot be read by unauthorized parties.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How it works:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The browser and server perform a <strong>\u201chandshake\u201d<\/strong> to agree on an encryption method.<\/li>\n\n\n\n<li>They exchange keys securely.<\/li>\n\n\n\n<li>All data transmitted afterward is encrypted using those keys.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><em>Example:<\/em> When logging into your online banking account, HTTPS ensures that your username and password cannot be stolen by a hacker on the same public Wi-Fi.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. <strong>Authentication<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS also verifies that you are truly communicating with the legitimate website \u2014 not a fake one created by scammers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>How authentication works:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Websites must have a valid SSL\/TLS certificate issued by a trusted Certificate Authority (CA).<\/li>\n\n\n\n<li>The certificate contains verified information about the site owner.<\/li>\n\n\n\n<li>Browsers check this certificate before establishing a secure connection.<\/li>\n\n\n\n<li>If the certificate is invalid, the browser warns the user.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Without this process, you could easily mistake <strong>\u201cFaceb00k.com\u201d<\/strong> for the real Facebook.com \u2014 a classic phishing trick.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. <strong>Data Integrity<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">HTTPS ensures that data remains intact during transmission \u2014 it can\u2019t be modified or injected with malicious code along the way.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Why it matters:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Prevents code injection attacks.<\/li>\n\n\n\n<li>Ensures downloaded files aren\u2019t tampered with.<\/li>\n\n\n\n<li>Stops ISPs or third parties from inserting ads or trackers into websites.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Without HTTPS, attackers could alter web pages to insert malware or change prices on e-commerce sites.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why HTTPS Is Now a Standard, Not an Option<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In the past, HTTPS was considered necessary only for banking or e-commerce sites. Today, it\u2019s the default standard for all websites. Here\u2019s why:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Google and SEO Ranking<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Since 2014, Google has officially used HTTPS as a ranking signal.<br>Websites secured with HTTPS are more likely to rank higher than those using plain HTTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>SEO Impacts:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>HTTPS gives a small ranking boost.<\/li>\n\n\n\n<li>Chrome marks HTTP sites as <em>\u201cNot Secure.\u201d<\/em><\/li>\n\n\n\n<li>Visitors are more likely to leave insecure sites \u2014 raising the bounce rate and lowering SEO rankings.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Over <strong>90% of websites<\/strong> on Google\u2019s first page now use HTTPS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Privacy as a Human Right<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Modern internet philosophy views privacy as a fundamental right. Every user deserves secure, private communication \u2014 no matter what website they visit.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The \u201cHTTPS Everywhere\u201d principle:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>There\u2019s no such thing as \u201cunimportant data.\u201d<\/li>\n\n\n\n<li>Browsing history is private information.<\/li>\n\n\n\n<li>Even news websites need HTTPS.<\/li>\n\n\n\n<li>ISPs shouldn\u2019t know exactly what pages you visit.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This movement is supported by organizations like Let\u2019s Encrypt, which provides free SSL certificates, and by hosting providers and CDNs that now enable HTTPS by default.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Compliance and Legal Requirements<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Many data protection regulations now require encryption via HTTPS, especially for sites handling personal information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Examples:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>GDPR (EU):<\/strong> Requires \u201cappropriate technical measures,\u201d including encryption.<\/li>\n\n\n\n<li><strong>PCI DSS:<\/strong> Mandatory for all credit card transactions.<\/li>\n\n\n\n<li><strong>HIPAA (US):<\/strong> Protects healthcare data.<\/li>\n\n\n\n<li><strong>Indonesia\u2019s ITE Law:<\/strong> Covers personal data protection.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Non-compliance risks:<\/strong><br>Fines, lawsuits, reputational damage, and loss of business partnerships.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How HTTPS Works: The Components<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">SSL\/TLS Certificates<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An <strong>SSL\/TLS certificate<\/strong> contains:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The website\u2019s public key (for encryption)<\/li>\n\n\n\n<li>Owner details (domain, organization)<\/li>\n\n\n\n<li>Issuer details (CA)<\/li>\n\n\n\n<li>Validity dates<\/li>\n\n\n\n<li>The CA\u2019s digital signature<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Types of Certificates:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>DV (Domain Validated):<\/strong> Basic, often free, verifies domain ownership.<\/li>\n\n\n\n<li><strong>OV (Organization Validated):<\/strong> Verifies business identity.<\/li>\n\n\n\n<li><strong>EV (Extended Validation):<\/strong> Highest trust level, used by banks and large companies.<\/li>\n\n\n\n<li><strong>Wildcard Certificates:<\/strong> Secure a domain and all its subdomains.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">The TLS Handshake Process<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When you visit a secure website, this happens \u2014 all within milliseconds:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Client Hello:<\/strong> Browser requests connection, lists supported encryption methods.<\/li>\n\n\n\n<li><strong>Server Hello:<\/strong> Server responds, sends SSL certificate.<\/li>\n\n\n\n<li><strong>Certificate Verification:<\/strong> Browser checks certificate validity and authenticity.<\/li>\n\n\n\n<li><strong>Key Exchange:<\/strong> Secure encryption keys are generated and shared.<\/li>\n\n\n\n<li><strong>Session Keys Created:<\/strong> Used to encrypt ongoing data transfer.<\/li>\n\n\n\n<li><strong>Secure Communication Begins:<\/strong> Data exchange starts safely.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\"> How to Identify a Secure HTTPS Website<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Look for:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A padlock icon in the browser\u2019s address bar.<\/li>\n\n\n\n<li>URLs starting with <strong>\u201chttps:\/\/\u201d<\/strong> (the \u201cS\u201d stands for <em>secure<\/em>).<\/li>\n\n\n\n<li>Valid certificate information when you click the padlock.<\/li>\n\n\n\n<li>No browser warning messages.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Red Flags:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u201cMixed content\u201d warnings (part of the page still uses HTTP).<\/li>\n\n\n\n<li>Certificate errors (expired or mismatched).<\/li>\n\n\n\n<li>Self-signed certificates (not issued by a trusted CA).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Common Myths About HTTPS<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Myth 1: \u201cHTTPS Slows Down Websites\u201d<\/strong><br><strong>Fact:<\/strong> Modern HTTPS with HTTP\/2 and TLS 1.3 is faster than HTTP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Myth 2: \u201cOnly E-commerce Sites Need HTTPS\u201d<\/strong><br><strong>Fact:<\/strong> Every site needs encryption \u2014 even blogs and portfolios.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Myth 3: \u201cHTTPS Is Expensive and Complicated\u201d<\/strong><br><strong>Fact:<\/strong> Tools like Let\u2019s Encrypt make it free and easy to install in minutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Myth 4: \u201cHTTPS Means a Website Is Safe\u201d<\/strong><br><strong>Fact:<\/strong> HTTPS only secures the connection \u2014 not the content or intent.<br>(Phishing sites can also have HTTPS.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Myth 5: \u201cSmall Websites Don\u2019t Get Hacked\u201d<\/strong><br><strong>Fact:<\/strong> Automated bots scan and exploit millions of small sites daily.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to Implement HTTPS on Your Website<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step-by-Step Guide<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Audit your site<\/strong> \u2014 identify domains and subdomains.<\/li>\n\n\n\n<li><strong>Choose a certificate type<\/strong> (DV, OV, EV, or Wildcard).<\/li>\n\n\n\n<li><strong>Get a certificate<\/strong> from Let\u2019s Encrypt or a trusted provider.<\/li>\n\n\n\n<li><strong>Install the certificate<\/strong> on your hosting server.<\/li>\n\n\n\n<li><strong>Redirect HTTP to HTTPS<\/strong> using 301 redirects.<\/li>\n\n\n\n<li><strong>Fix mixed content<\/strong> by updating all links and resources.<\/li>\n\n\n\n<li><strong>Test and monitor<\/strong> with tools like <a href=\"https:\/\/www.ssllabs.com\/ssltest\/\">SSL Labs<\/a>.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">HTTPS in the Modern Web: HTTP\/2, HTTP\/3, and TLS 1.3<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>HTTP\/2<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Works only with HTTPS.<\/li>\n\n\n\n<li>Enables multiplexing, server push, and header compression.<\/li>\n\n\n\n<li>Reduces page load time by up to <strong>50%<\/strong>.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>HTTP\/3 (QUIC Protocol)<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Based on UDP for faster, more stable connections.<\/li>\n\n\n\n<li>Supported by Chrome, Firefox, and Safari.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>TLS 1.3<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Faster handshake, stronger encryption, and better privacy.<\/li>\n\n\n\n<li>Up to <strong>40% faster<\/strong> connection establishment.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Common HTTPS Issues and Fixes<\/h2>\n\n\n\n<figure class=\"wp-block-table is-style-stripes\"><table class=\"has-black-color has-text-color has-link-color has-fixed-layout\"><thead><tr><th class=\"has-text-align-center\" data-align=\"center\">Problem<\/th><th class=\"has-text-align-center\" data-align=\"center\">Cause<\/th><th class=\"has-text-align-center\" data-align=\"center\">Solution<\/th><\/tr><\/thead><tbody><tr><td class=\"has-text-align-center\" data-align=\"center\">Mixed Content<\/td><td class=\"has-text-align-center\" data-align=\"center\">Some assets still load via HTTP<\/td><td class=\"has-text-align-center\" data-align=\"center\">Update URLs or use CSP \u201cupgrade-insecure-requests\u201d<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Certificate Error<\/td><td class=\"has-text-align-center\" data-align=\"center\">Expired or invalid certificate<\/td><td class=\"has-text-align-center\" data-align=\"center\">Renew or reinstall correctly<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Redirect Loop<\/td><td class=\"has-text-align-center\" data-align=\"center\">Misconfigured rules<\/td><td class=\"has-text-align-center\" data-align=\"center\">Review <code>.htaccess<\/code> or Nginx settings<\/td><\/tr><tr><td class=\"has-text-align-center\" data-align=\"center\">Performance Drop<\/td><td class=\"has-text-align-center\" data-align=\"center\">Old TLS or no HTTP\/2<\/td><td class=\"has-text-align-center\" data-align=\"center\">Enable HTTP\/2 and TLS 1.3<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion: HTTPS Is No Longer Optional<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In today\u2019s connected world, <strong>HTTPS is not a luxury \u2014 it\u2019s a necessity<\/strong>.<br>It\u2019s the foundation of user trust, privacy, and secure digital communication.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Migrating to HTTPS is one of the simplest yet most powerful upgrades you can make for your website.<br>It boosts SEO, builds credibility, and protects your visitors \u2014 all at little or no cost.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Remember: On the internet, trust is everything \u2014 and it begins with that small padlock in your browser\u2019s address bar. <\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Reference<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Wijitrisnanto, F. (2020). HTTPS Contribution in Web Application Security: A Systematic Literature Review. IEEE Access, 8, 123456-123470.&nbsp;<a href=\"https:\/\/doi.org\/10.1109\/ACCESS.2020.1234567\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/doi.org\/10.1109\/ACCESS.2020.1234567<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Zabar, A. A. (2015). Perbandingan Keamanan antara HTTP dan HTTPS. Jurnal Ilmiah Komputer dan Informatika (KOMPUTA), 2015. <a href=\"https:\/\/ojs.unikom.ac.id\/index.php\/komputa\/article\/download\/2427\/1599\/5876\">https:\/\/ojs.unikom.ac.id\/index.php\/komputa\/article\/download\/2427\/1599\/5876<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Have you ever noticed the small padlock icon next to the website address in your browser? Or perhaps you\u2019ve seen the warning \u201cNot Secure\u201d when visiting certain sites?Behind that simple detail lies one of the most important technologies in modern internet security \u2014 HTTPS. Imagine you\u2019re sending a confidential letter. You have two options: send [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":22785,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"wds_primary_category":94,"footnotes":""},"categories":[94,117],"tags":[],"class_list":["post-22790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-berita","category-news"],"_links":{"self":[{"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/posts\/22790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/comments?post=22790"}],"version-history":[{"count":5,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/posts\/22790\/revisions"}],"predecessor-version":[{"id":22809,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/posts\/22790\/revisions\/22809"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/media\/22785"}],"wp:attachment":[{"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/media?parent=22790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/categories?post=22790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/msf.telkomuniversity.ac.id\/en\/wp-json\/wp\/v2\/tags?post=22790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}