Lesson 3 of 3

HTTPS and security headers

2 min

What HTTPS protects

HTTPS wraps HTTP in TLS encryption. It guarantees three things:

Confidentiality: nobody on the network can read the traffic, e.g. on public Wi-Fi.
Integrity: nobody can change the page on the way.
Authenticity: the certificate proves you reached the real domain.

It does not prove the site is trustworthy. Phishing sites have valid certificates too.

DV (domain validated): proves control of the domain. Free and automatic; fine for almost all sites.
OV/EV: also verify the organisation, for when that identity matters to customers.

Certificates expire, so automate renewal.

Headers are instructions the server sends with every page. A few go a long way:

Strict-Transport-Security (HSTS): always use HTTPS for this site, even if someone types http://.
Content-Security-Policy (CSP): only run scripts from sources you trust, which blocks most injected code.
X-Content-Type-Options: nosniff: don't guess file types.
X-Frame-Options: DENY: don't let other sites embed yours in a frame (stops clickjacking).
Referrer-Policy: limit what URL information leaks to other sites.

curl -I https://your-site.com

Look for the headers above in the response. Free scanners like securityheaders.com grade them for you.

HTTPS and headers protect the connection and the browser. They don't fix vulnerable code or weak passwords, so they're one layer, not the whole wall.