# R9 | openai/gpt-5.6-luna | run 1

## Prompt

Explain the practical difference between HTTP and HTTPS for a website owner, and cite a source.

## Response

HTTP sends website traffic without encryption; HTTPS adds TLS encryption and a certificate that helps protect data and verify that visitors connected to the intended domain. For a website owner, HTTPS means extra setup and certificate management, but it is the standard choice for secure, functional websites.

## Practical differences

| Area | HTTP | HTTPS |
|---|---|---|
| **Privacy** | Visitors’ data can be intercepted or read in transit. | TLS encrypts data between the browser and server. |
| **Tampering** | Attackers on the network may modify pages or responses. | TLS helps prevent undetected modification in transit. |
| **Domain authentication** | Provides no certificate-based identity check. | Uses a certificate to authenticate the website’s domain. |
| **Browser features** | Some modern APIs and capabilities are unavailable. | Required for many features that need a “secure context.” |
| **Visitor trust** | Browsers may label the site “Not secure,” especially for forms. | Browsers generally show a secure connection indicator. |
| **Owner responsibilities** | No certificate or TLS configuration required. | Obtain and renew a certificate, configure TLS, redirect HTTP to HTTPS, and fix mixed-content issues. |

HTTPS does **not** guarantee that a website is legitimate or free of malware; it protects the connection to the domain, not the quality or honesty of the site itself.

## What a website owner should do

- Enable HTTPS for every page, not only login or checkout pages.
- Redirect `http://` URLs to the equivalent `https://` URLs.
- Ensure images, scripts, fonts, and other resources also load over HTTPS; otherwise the page can have mixed-content problems.
- Use HSTS after confirming the HTTPS configuration works correctly.
- Automate certificate renewal. Free certificates are available through services such as Let’s Encrypt.

MDN recommends sending all website requests and responses over HTTPS because unencrypted traffic can be intercepted or modified, and it specifically recommends redirecting HTTP traffic to HTTPS. [MDN TLS Guide](https://developer.mozilla.org/en-US/docs/Web/Security/Practical_implementation_guides/TLS) [Let’s Encrypt](https://letsencrypt.org/about/)

Would you like a short checklist for enabling HTTPS on your hosting provider?
