HTTP · HTTPS
HyperText Transfer Protocol / HyperText Transfer Protocol Secure
What is HTTP?
- HTTP = the web communication protocol
- HTTPS = the encrypted, safer version
- A padlock means HTTPS
Whether the address bar shows https is not a cosmetic question; it changes how your whole site works. Payment gateway (PG) providers will not open a payment window on an http page, and Kakao and Naver social login reject callback URLs that are not https at registration. Browsers label input fields on http pages as 'Not secure' and block features such as location, camera, and push notifications outright. HTTPS is not a security option but a prerequisite for functionality, and sites without it lose features one by one.
There are three distinctions to check in practice. First, the channel differs: HTTP uses port 80 and HTTPS uses port 443, so start by checking that 443 is open on your internal firewall. Second, certificates come in two kinds: DV, which only verifies domain ownership, and OV or EV, which also verify the business entity. Costs range from free to several hundred thousand KRW a year. Let's Encrypt, a widely used free certificate authority, issues certificates with a 90-day validity period, so without auto-renewal, outages recur every three months. Third, check the encryption version too. TLS 1.0 and 1.1 are already deprecated, and the current baseline is TLS 1.2 or higher, with 1.3 recommended.
The most common misconception is that a padlock means a trustworthy site. HTTPS only hides what is exchanged; it does not guarantee the other party is honest, and phishing sites also get free certificates and display the padlock. Mixed content is another headache: an https page that loads only its images or scripts over http. The browser blocks those resources, so the cart or payment button stops working, and because everything looks fine on a desktop, the problem is found late. An expired certificate is not a minor inconvenience either. From the day it expires, a full-page warning appears and most visitors simply hit the back button. Assuming an internal admin page is fine is also risky: the moment an administrator logs in over café Wi-Fi, the admin account travels in plain text.
Jaryong KooMarketing PhD and authority in AI, data analytics, and personal branding
John KimAuthor of B2B Marketing Design and CEO of Nanum Consulting| Category | HTTP | HTTPS |
|---|---|---|
| Encryption | None | Yes (TLS) |
| Safe | Vulnerable to eavesdropping and tampering | Secure (padlock shown) |
| Trust · SEO | Disadvantage | Expected · Advantage |
HTTP was devised by Tim Berners-Lee in 1989–1991, when he created the World Wide Web. HTTPS, which adds encryption for security, later became the standard.
Consider a hypothetical case. Company A, an industrial tool distributor with 52 employees and KRW 21 billion (≈ US$15,711,500) in annual revenue, takes dealer orders through a B2B online store it built two years ago. It installed a free certificate and never touched it again. At 9:20 a.m. on a Monday, dealers began calling to say 'the site is showing a danger warning,' with 11 calls in 30 minutes. Orders, which normally average 140 a day, stalled at 6 all morning.
- When Assistant Manager Kim, who runs the company website, clicked the address bar, he found the certificate had expired at midnight the night before. During the server migration, the 90-day auto-renewal script had been left out entirely.
- When he called the hosting provider’s technical support, the answer was 'Renewal takes 10 minutes, but it takes about an hour to propagate.' In the meantime, Assistant Manager Kim texted all 78 dealerships that phone orders would be taken that morning.
- After recovery, Team Lead Park, who heads IT, ordered a full audit. It also uncovered another problem: some 300 product images were hard-coded with http addresses, which had kept the cart button from working on mobile.
- Team Lead Park set up an internal messenger alert 30 days before expiry, changed http access to redirect to https with a 301, and added a rule on the payment page that blocks connections below TLS 1.2.
- Three months later, the mobile order abandonment rate had fallen from 18% to 7%, and through two renewal cycles there was not a single expiry outage. In a meeting, Team Lead Park said, 'One padlock was that day’s entire revenue.'