# R9 | anthropic/claude-opus-5 | run 1

## Prompt

Explain the practical difference between HTTP and HTTPS for a website owner, and cite a source.

## Response

HTTPS is HTTP wrapped in TLS encryption, and for a site owner the difference shows up in four practical places: browser trust indicators, search rankings, analytics accuracy, and access to modern web features. In 2026, HTTP is effectively a broken default — browsers actively flag it and most hosting platforms provision free certificates automatically.

## The Core Technical Difference

HTTP sends requests and responses in plaintext. Anyone positioned between the visitor and your server — an ISP, a network operator, or someone on the same public Wi-Fi — can read or modify the traffic. On a shared network such as a coffee shop, an observer can "packet sniff" and discover sensitive information about your visitors. HTTPS encrypts that channel and verifies your server's identity via a certificate.

## What Actually Changes for You

| Area | HTTP | HTTPS |
|---|---|---|
| Browser display | "Not Secure" warning | Padlock, no warning |
| Search ranking | No credit | Lightweight positive signal |
| Referral analytics | Referrer data often stripped | Referrers preserved |
| Protocol support | HTTP/1.1 only in practice | HTTP/2 and HTTP/3 available |
| Forms and payments | Warnings on password/card fields | Clean experience |
| Cost | Free | Free via Let's Encrypt |

**Browser warnings are the biggest practical hit.** Chrome began flagging HTTP sites as "not secure" in 2018, and other browsers followed with their own visual warnings. That warning reduces trust and increases bounce rates.

**Ranking benefit is real but small.** Google confirmed the signal in 2014: "we're starting to use HTTPS as a ranking signal," noting it was "only a very lightweight signal—affecting fewer than 1% of global queries," and carrying less weight than high-quality content — [Google Search Central](https://developers.google.com/search/blog/2014/08/https-as-ranking-signal). Treat it as a tie-breaker, not a growth strategy. Google has also confirmed HTTPS is not considered when indexing a site — it affects ranking only, never whether pages get indexed.

**Analytics get cleaner.** Traffic from an HTTPS site to an HTTP site loses referrer data, so those visits land in "direct traffic." Migrating to HTTPS preserves referral data and keeps it accurately attributed in analytics.

**Performance is not a penalty.** A common worry is that encryption slows pages down, but modern implementations generally make sites faster, because HTTPS unlocks HTTP/2, which improves load times and Core Web Vitals.

## Migration Checklist

- Get a free certificate via [Let's Encrypt](https://letsencrypt.org/) or your host's one-click SSL
- 301-redirect every HTTP URL to its HTTPS equivalent — add redirect rules in `.htaccess` if you're editing server config directly
- Update internal links, menus, and widgets to HTTPS to avoid mixed-content warnings
- Add and verify the HTTPS property in Google Search Console, then declare it canonical
- Update canonical tags, sitemaps, and your `robots.txt` sitemap reference

The 301 redirects are the step people botch most often. Skip them and you fragment link equity across two versions of every URL.

Would you like the specific redirect and HSTS configuration for your server stack (Apache, Nginx, or a managed host like WordPress/Shopify)?
