# R9 | openai/gpt-5.6-luna | run 2

## Prompt

Explain the practical difference between HTTP and HTTPS for a website owner, and cite a source.

## Response

HTTP sends a website’s traffic without encryption; HTTPS sends the same HTTP traffic through TLS, protecting it from interception and tampering while helping browsers verify the server’s identity. For a website owner, HTTPS means configuring a TLS certificate, redirecting HTTP requests, and ensuring all resources load securely. [MDN: TLS](https://developer.mozilla.org/en-US/docs/Web/Security/Defenses/Transport_Layer_Security)

## Practical differences

| Area | HTTP | HTTPS |
|---|---|---|
| **Privacy** | Data can potentially be read in transit, including form submissions and session information. | Traffic is encrypted between the visitor’s browser and your server. |
| **Integrity** | An attacker on the network may alter pages or responses. | TLS helps detect modification in transit. |
| **Authentication** | The browser has no cryptographic proof that it reached the intended site. | A valid certificate helps authenticate your domain to the browser. |
| **Browser behavior** | May show “Not secure” warnings and limits access to some browser features. | Enables secure-context features and displays the padlock or equivalent security indicator. |
| **Owner setup** | No certificate is required. | Requires a valid TLS certificate and correct server configuration. |
| **Deployment work** | Pages can be served directly over `http://`. | Usually requires permanent redirects from HTTP to HTTPS, updating internal links, fixing mixed content, and optionally enabling HSTS. |

## What a website owner should do

- Install a valid TLS certificate, typically through the hosting provider or a certificate authority.
- Redirect every `http://` URL to its corresponding `https://` URL.
- Update canonical URLs, internal links, scripts, images, stylesheets, and third-party resources.
- Test forms, logins, APIs, cookies, and redirects after the change.
- Consider enabling HSTS after confirming that the entire site and its subdomains support HTTPS. [MDN: HSTS](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/TLS)

In practice, HTTPS should be the default for the entire site—not only pages that accept passwords or payments. Would you like a short migration checklist for moving an existing HTTP site to HTTPS?
