It sounds like this“When I send something to a website it goes straight from my device to the site, so only the site can see it.”
Thinking your data goes straight to the site
Why it feels right
We picture the internet as a line between two points. You type, the site answers, and nothing is between you. That picture comes from how it feels to use: the page appears at once, as if the site were in the next room. Because the machines in the middle are invisible and never speak, it is easy to forget they are there.
Why it’s wrong
Your data crosses many machines on the way: your router, your internet provider, and several networks in between. With plain HTTP each of them can read it, and even change it. HTTPS scrambles it so that only your device and the site can make sense of it.
A worked example
In reality a request is cut into small packets and handed from machine to machine, perhaps a dozen or more hops between you and the site: your home router, your internet provider's equipment, and several networks that pass it on. Each hop has to read the packet's address to know where to send it next, and with plain HTTP the rest of the packet is readable too.
That means someone running the Wi-Fi in a cafe, a provider, or anyone who has tapped a link can read the pages you ask for and what you type into a form. It also means they can change it. Some providers have been caught adding adverts or messages to plain HTTP pages on the way past.
This is true for every page, not only login pages. A search, an article about a health worry or a form with your address all cross the same machines. HTTPS fixes this for all of it, which is why browsers now treat plain HTTP as not secure, even on a site with no login at all.
How to catch yourself
- You say HTTP is fine for a page that has no password on it.
- You think a Wi-Fi password makes a connection private from everyone.
- You picture the internet as one wire from you to the site.
What to hold instead
Data crosses many machines on its way to a site. With plain HTTP each can read it and change it. HTTPS scrambles it so that only the two ends can understand it, whichever machines carry it.
Where you’ll meet it
- Using public Wi-Fi at a cafe or an airport.
- Wondering why even a simple news site now uses HTTPS.
- Understanding how a provider could inject adverts into a page.
Questions people ask
- Can someone on public Wi-Fi see what I do on a website?
- On plain HTTP, yes: they can read the pages and anything you type. On HTTPS they can see which site you connect to, but the pages and what you type are scrambled.
- Why does every site need HTTPS, even one with no login?
- Because the page can be read and altered on the way, whatever it is. Without HTTPS, someone in the middle can see which articles you read, or add something harmful to the page you receive.