HTTPS

What it means

HTTPS is ordinary web traffic with encryption wrapped around it. It hides the contents from anyone on the network in between, detects tampering along the way, and proves the server you reached matches the address you typed.

That is the whole job. It protects the journey. It says nothing about what either end does with the data once the data arrives.

Why it matters

Without it, anybody sharing a network with your users can read sessions and passwords as they pass. OWASP recommends TLS on every page rather than the login page alone, because an unencrypted page leaks session tokens and invites injected scripts.

The padlock is where readers go wrong. A malicious site can hold a perfect certificate, and a perfect certificate can sit in front of an application that hands one customer another customer's records. Encryption on the wire and correct behaviour in code are separate problems, and most incidents live in the second.

How it shows up

Gaps are usually partial rather than total. An old subdomain still answering on plain HTTP. An API that accepts both. A redirect to the secure version with no Strict-Transport-Security header, so the first request still travels in the clear. A session cookie missing the Secure flag.

Certificate expiry belongs on the list too, since it takes sites offline every week of the year. Put renewal on a calendar somebody actually reads, or automate it.

Internal traffic hides the last gap. One service calls another without encryption because both sit behind the same boundary, and that assumption holds until somebody reaches the network. Cyberlop does not grade your firewall and does not scan your network. We test what the application does once the connection is up, and show you the evidence.