HTTPS is HTTP over TLS: the encrypted version of the basic web protocol. Adopted as the universal default in modern browsers (the 2018 Chrome and Firefox HTTPS-default initiatives, the Let’s Encrypt certificate authority making free certificates universal), with most major sites enforcing HTTPS-only via HSTS preloading. The structural protection that defeats most network-layer eavesdropping on web traffic; the failure mode is the increasingly-rare site that still serves HTTP or that serves a mixed-content page.
What it means in practice
The HTTPS architecture provides three properties: confidentiality (the network observer cannot read content), integrity (the content cannot be modified in transit), and authentication (the user has cryptographic verification that the server is the legitimate operator of the domain). The certificate-trust model relies on Certificate Authorities issuing certificates that browsers trust by virtue of the CA being in the browser’s root store. Compromise of a CA (the 2011 DigiNotar breach is the canonical case) breaks the trust model; subsequent improvements (Certificate Transparency, the 2017 deprecation of Symantec certificates, the broader CA-monitoring infrastructure) have made CA-level attacks harder but not impossible. The 2018 mandatory-HTTPS shift means most modern internet activity has the HTTPS protection by default; the remaining exposure is on the small set of HTTP-only sites and on the metadata layer (TLS Server Name Indication still leaks the destination hostname until ECH deployment is universal).
Where it shows up
Operationally relevant for: every modern web interaction, with the protection so universal that most users do not think about it explicitly. The remaining attack surface: HTTP-only sites (rare in 2026 but exist; the browser HTTPS-Only mode in Firefox and the equivalent in Chrome catch these), mixed-content pages (HTTPS page loading HTTP resources; modern browsers block this by default), self-signed certificate errors (the “your connection is not private” warning indicates either a misconfigured site or an active MITM attempt; never click through on this warning), and the structural threat of certificate-trust attacks via compromised CAs or compelled-certificate-injection in adversarial jurisdictions. The Predaxia operational frame: HTTPS is the structural baseline that defeats most network-layer eavesdropping; the additional layers (VPN for IP-and-DNS protection, end-to-end encryption for content protection beyond the server, hardware-key 2FA for credential protection) sit on top of the HTTPS foundation.
What you can change today
Three habits. First, enable HTTPS-Only mode in Firefox (Settings, Privacy and Security, HTTPS-Only Mode, Enable in all windows) or the equivalent in Chrome (Settings, Privacy and security, Always use secure connections); the browser will refuse to connect to HTTP-only sites or warn before downgrading. Second, never click through certificate warnings; the “your connection is not private” message is a serious signal of either site misconfiguration or active MITM, and the cost of one missed visit is much smaller than the cost of one compromised session. Third, awareness that HTTPS protects content but not all metadata: SNI leakage means the network observer still sees which domains you visit until ECH (Encrypted Client Hello) is universally deployed, which is in progress as of 2026 but not yet complete.