# R9 | moonshotai/kimi-k3 | run 2

## Prompt

Explain the practical difference between HTTP and HTTPS for a website owner, and cite a source.

## Response

HTTP sends all traffic in plaintext, while HTTPS wraps the same protocol in TLS encryption — protecting visitor data, proving your server's identity, and preventing tampering. For a website owner, this difference is no longer optional: browsers, search engines, and modern web features all effectively require HTTPS.

## Practical Differences for Website Owners

| Factor | HTTP | HTTPS |
|---|---|---|
| Data in transit | Readable and modifiable by anyone on the network path | Encrypted and tamper-proof via TLS |
| Browser display | Flagged as "Not Secure" in the URL bar | Padlock icon; trusted appearance |
| SEO | Penalized in Google rankings | Positive ranking signal |
| Modern features | Geolocation, push notifications, and Service Workers blocked | Full access to modern browser APIs |
| Default port | 80 | 443 |

## Why It Matters

**Security and integrity.** Unencrypted HTTP traffic can be viewed *and* modified in transit, enabling attackers or intermediaries to inject ads or malware into your pages and steal credentials your visitors enter [letsencrypt.org](https://letsencrypt.org/docs/why-all-https/).

**Browser trust.** Since Chrome 68 (July 2018), all HTTP sites are flagged as "not secure," and other browsers followed suit — a warning that directly erodes visitor confidence [cloudflare.com](https://www.cloudflare.com/learning/ssl/why-use-https/).

**Search rankings.** Google has used HTTPS as a ranking signal since 2014, so staying on HTTP costs you search visibility [100plus.tools](https://100plus.tools/comparisons/http-vs-https).

**Cost is no longer a barrier.** Free, automated certificates from Let's Encrypt dropped the price of HTTPS to zero, and switching typically involves installing a certificate plus setting 301 redirects from HTTP to HTTPS [cloudflare.com](https://www.cloudflare.com/learning/ssl/why-use-https/).

The only acceptable HTTP use cases are local development and fully trusted internal networks; everything public-facing should run HTTPS [100plus.tools](https://100plus.tools/comparisons/http-vs-https).

Would you like a step-by-step guide for migrating an existing site from HTTP to HTTPS?
