{"post":{"slug":"http-vs-https-2026","title":"HTTP vs HTTPS in 2026: why plain HTTP is effectively dead","excerpt":"HTTPS is no longer optional and has not been for years. This 2026 guide explains the technical differences, TLS 1.3 improvements, and what still trips teams up.","category":"code","date":"March 18, 2026","author":"ByteLedger Team","content":"<span class=\"dropcap\">H</span>TTP sends everything in plaintext. Every header, every cookie, every form submission, every URL parameter — all readable by anyone on the network path between client and server. HTTPS wraps HTTP in TLS, encrypting that traffic and authenticating the server's identity. In 2026, shipping a public-facing service over plain HTTP is not a technical trade-off — it is a misconfiguration.\n\n## What changed in 2026\n\n- **TLS 1.0 and 1.1 are disabled everywhere** — all major browsers and servers dropped support. TLS 1.2 is the minimum; TLS 1.3 is the default.\n- **Let's Encrypt has issued over 4 billion certificates** — automated ACME-based issuance is built into every major hosting platform, reverse proxy, and cloud provider.\n- **HTTP/2 requires HTTPS** — all browser implementations of HTTP/2 mandate TLS. If you want multiplexed streams (faster page loads), you must use HTTPS.\n- **HTTP/3 (QUIC) requires HTTPS** — QUIC has TLS 1.3 baked in at the protocol level; there is no plaintext HTTP/3.\n- **Service mesh mTLS is standard** — Istio, Linkerd, and AWS App Mesh default to mutual TLS for east-west (service-to-service) traffic.\n\n## What HTTPS actually does\n\n```text\nPlain HTTP request:\nGET /account?token=abc123 HTTP/1.1\nHost: example.com\nCookie: session=xyz789\nAuthorization: Bearer secret-token\n\nAll of the above is visible to any network observer (ISP, coffee shop router, MITM proxy).\n\nHTTPS (TLS 1.3):\n- TLS handshake authenticates the server via its certificate\n- A shared session key is derived (ECDH key exchange)\n- All subsequent data is encrypted with AES-GCM or ChaCha20-Poly1305\n- Headers, body, URL path, and cookies are all encrypted\n- Only the destination IP and SNI hostname are visible to observers\n```\n\n## TLS 1.3 vs TLS 1.2 performance\n\n| Metric | TLS 1.2 | TLS 1.3 |\n| --- | --- | --- |\n| Handshake round trips | 2 (full) | 1 |\n| 0-RTT resumption | No | Yes (with session tickets) |\n| Cipher suites | Many (some weak) | 5, all strong |\n| Forward secrecy | Optional | Mandatory (ECDHE) |\n| Handshake latency (same datacenter) | ~8 ms | ~4 ms |\n| Handshake latency (cross-continent) | ~200 ms | ~100 ms |\n\nTLS 1.3 with session resumption approaches zero additional latency for returning clients — the \"HTTPS is slow\" complaint is a TLS 1.0/1.2 era artefact.\n\n## Certificate setup with Let's Encrypt\n\n```bash\n# Certbot (nginx, standalone)\ncertbot --nginx -d example.com -d www.example.com\n\n# Caddy (zero config — auto-HTTPS by default)\n# Caddyfile:\nexample.com {\n  reverse_proxy localhost:3000\n}\n# Caddy obtains and renews the certificate automatically.\n\n# Kubernetes with cert-manager\nkubectl apply -f https://github.com/cert-manager/cert-manager/releases/latest/download/cert-manager.yaml\n\n# Then annotate your Ingress:\n# cert-manager.io/cluster-issuer: \"letsencrypt-prod\"\n```\n\n## HSTS: locking in HTTPS\n\n```nginx\n# nginx: send HSTS header\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\n```\n\nWith HSTS set:\n- Browsers refuse to connect over HTTP for the declared duration\n- `preload` submits your domain to browser preload lists (hard-baked HTTPS enforcement, no first-visit downgrade possible)\n- `includeSubDomains` covers all subdomains — only add if all subdomains serve HTTPS\n\n## Service-to-service: mTLS\n\nFor internal services, HTTPS authenticates the server but not the client. Mutual TLS (mTLS) adds client certificate validation:\n\n```go\n// Go server: require client certificate\ntlsConfig := &tls.Config{\n    ClientAuth: tls.RequireAndVerifyClientCert,\n    ClientCAs:  certPool, // load your internal CA\n    MinVersion: tls.VersionTLS13,\n}\nserver := &http.Server{\n    TLSConfig: tlsConfig,\n    Addr:      \":8443\",\n}\n```\n\nIn Kubernetes, service mesh solutions (Istio, Linkerd) inject mTLS automatically with SPIFFE/SPIRE identity — you do not write TLS code at all.\n\n## How to pick\n\n1. **Public-facing web service?** → HTTPS, full stop. Use Let's Encrypt + certbot or Caddy.\n2. **Service-to-service in a Kubernetes cluster?** → mTLS via service mesh, or at minimum TLS with internal CA.\n3. **Local development?** → HTTP is fine; use `mkcert` for localhost HTTPS if you need to test HTTPS-only browser APIs (Service Workers, Web Crypto).\n4. **Static files on a CDN?** → CDN handles TLS termination; configure HTTPS-only redirect at the CDN edge.\n\n## Common mistakes\n\n**Serving mixed content (HTTPS page loading HTTP assets).** Browsers block active mixed content (scripts, iframes) and warn on passive (images). Audit with Chrome DevTools > Security panel.\n\n**Not renewing certificates.** Let's Encrypt certs expire in 90 days. Automate renewal with `certbot renew` in a cron job or use a platform that auto-renews (Caddy, Fly.io, Vercel, Cloudflare).\n\n**Using a wildcard cert without understanding SANs.** Modern browsers require the Subject Alternative Name extension, not just the Common Name. certbot handles this; manually created certs sometimes miss it.\n\n**Disabling HTTPS for \"internal\" load balancer to backend traffic.** Unencrypted internal traffic is vulnerable to lateral movement after a network compromise. Use TLS all the way to the origin.\n\n## What to skip\n\n- **Self-signed certs in production** — use Let's Encrypt or an internal CA with cert-manager. Self-signed certs require distributing root certs to every client, which is operationally painful.\n- **HTTP on port 80 without redirect** — always redirect 301 to HTTPS. Some crawlers and monitoring tools still hit port 80.\n- **Extended Validation (EV) certificates** — browsers removed the EV indicator from the address bar. EV certs cost more and offer no UX benefit over DV (Let's Encrypt) certs.\n\n## FAQ\n\n**Does HTTPS hide the domain I am visiting?**\nThe SNI (Server Name Indication) field in the TLS handshake reveals the hostname to network observers in most configurations. Encrypted Client Hello (ECH) hides the SNI; it is supported by Cloudflare and some browsers in 2026 but not yet universal.\n\n**Can HTTPS be decrypted by my employer or ISP?**\nYes, with a MITM proxy that presents a certificate your device trusts (e.g., corporate root CA installed on your laptop). This is called TLS inspection and is common in corporate environments.\n\n**Is HTTP/2 faster than HTTP/1.1 over HTTPS?**\nMeaningfully so — multiplexed streams eliminate the per-request connection overhead. Most performance gains attributed to \"switching to HTTPS\" are actually HTTP/2 gains.\n\n**What is HSTS preloading and should I use it?**\nPreloading submits your domain to browser-embedded lists so HTTPS is enforced before the first request. Only add `preload` if you are certain all subdomains serve HTTPS — removing a domain from the preload list takes months.\n\n## Where to go next\n\n- [TCP vs UDP in 2026](/blog/tcp-vs-udp-2026)\n- [REST vs GraphQL in 2026](/blog/rest-vs-graphql-2026)\n- [How to handle secrets in 2026](/blog/how-to-handle-secrets-2026)","hue":306,"metaTitle":"HTTP vs HTTPS 2026: Security and Performance Guide","metaDescription":"Complete 2026 guide to HTTP vs HTTPS. TLS 1.3 overhead, certificate setup, HSTS, mTLS for internal services, and common misconfiguration mistakes.","keywords":["http vs https 2026","https vs http security","tls 1.3 explained 2026","https performance overhead","lets encrypt certificate 2026","hsts http strict transport security","mtls service to service 2026","https certificate setup","http2 https requirement","https mixed content errors"],"tldr":["**HTTPS encrypts everything in transit** — headers, bodies, cookies, and URLs are all protected; plain HTTP sends all of it in cleartext.","**TLS 1.3 (the default in 2026) adds only one round trip** — the performance argument against HTTPS is dead; TLS handshake overhead is under 5 ms on modern stacks.","**Let''s Encrypt killed the cost argument** — free, auto-renewing certificates are table stakes in 2026; there is no budget justification for plain HTTP.","**HSTS and HTTPS-only flags prevent downgrade attacks** — configuring them is a one-line change that stops the most common MITM vector.","**Skip:** running plain HTTP for \"internal\" services — inter-service traffic is not safe from lateral movement attacks; mTLS is the right default for service-to-service."],"readTime":"5 min read","wordCount":1044},"related":[{"slug":"how-to-set-up-ssl-2026","title":"How to set up SSL in 2026: TLS, certificates, and HTTPS done right","excerpt":"HTTPS is non-negotiable in 2026 — browsers flag plain HTTP, and search engines penalize it. Here is how to get certificates, configure TLS, and stay secure.","category":"code","date":"April 3, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":309},{"slug":"ssl-tls-explained-2026","title":"SSL/TLS explained in 2026: how HTTPS actually secures your connection","excerpt":"TLS 1.3 is now the minimum bar, certificate lifetimes are shrinking to 90 days, and post-quantum handshakes are shipping. Here is the full picture.","category":"code","date":"April 7, 2026","author":"ByteLedger Team","readTime":"5 min read","hue":311},{"slug":"what-is-https-2026","title":"What is HTTPS in 2026? Secure web connections explained","excerpt":"HTTPS is HTTP with encryption, so data between your browser and a site cannot be read or altered in transit. Here is how it works and why it matters.","category":"code","date":"May 8, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":160}],"sameCategory":[{"slug":"bazel-build-explained-2026","title":"Bazel Explained: What Hermetic Builds Actually Cost","excerpt":"Bazel delivers reproducible, precisely cached builds and demands that you describe everything. Here is what you get, what it costs, and who should say no.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":145},{"slug":"graphql-federation-2026","title":"GraphQL Federation: One Graph, Many Teams","excerpt":"Federation composes independently-owned subgraphs into a single API. Here is what it solves, the operational cost it adds, and when a simpler gateway is enough.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":300},{"slug":"hermetic-builds-explained-2026","title":"Hermetic Builds Explained: Same Inputs, Same Output","excerpt":"A hermetic build depends only on declared inputs. Here is what that property gives you, the common leaks that break it, and how to move toward it incrementally.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":130},{"slug":"monorepo-tooling-compared-2026","title":"Monorepo Tooling Compared: What You Actually Need","excerpt":"Monorepo tools solve task orchestration and caching, not repository layout. Here is what each tier provides and how to tell when you have outgrown the simple option.","category":"code","date":"August 19, 2026","author":"ByteLedger Team","readTime":"3 min read","hue":150}],"newer":{"slug":"hsa-vs-ppo-2026","title":"HSA vs PPO in 2026: which health plan actually saves you money","excerpt":"Choosing between an HSA-eligible HDHP and a PPO is one of the highest-value benefits decisions you make each year. Here is how to run the real numbers.","category":"finance","date":"March 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":284},"older":{"slug":"infrastructure-as-code-2026","title":"Infrastructure as code in 2026: Terraform, Pulumi, and what actually works","excerpt":"Managing cloud infra by clicking in a console doesn't scale and doesn't survive team growth. Here is the honest 2026 guide to infrastructure as code.","category":"code","date":"March 18, 2026","author":"ByteLedger Team","readTime":"4 min read","hue":307}}