What is the difference between HTTP and HTTPS?

HTTPS is HTTP over TLS; data is encrypted before being sent and the server's identity is verified with a certificate.

Is a free SSL certificate secure?

Yes — Let's Encrypt issues a valid certificate trusted by browsers. The difference from paid certificates lies in identity validation level and services, not weaker encryption.

Why is my site shown as 'Not Secure' after enabling HTTPS?

Usually because of mixed content (http resources on the page) or an invalid/expired certificate. Complete the redirects and renew the certificate properly.

What is HSTS and should I enable it?

HSTS tells the browser to communicate only over https and prevents downgrading to http. Enable it after you're sure HTTPS is fully working.

HTTPS and TLS Certificates: Why and How to Enable Web Encryption

When an https page loads, the browser and server perform a TLS handshake before any data exchange. At that moment the server's identity is verified with a digital certificate, and a temporary key for the following encryption is agreed upon.

Symmetric and asymmetric encryption: TLS's clever combination

Symmetric (AES): fast, used for the data itself
Asymmetric (RSA / ECDHE): slower, but for secure key exchange and signing

TLS first exchanges the session key securely with asymmetric encryption, then encrypts the rest of the data with symmetric encryption. This very combination is what makes speed and security possible at the same time.

Why should every site have HTTPS?

Even if the data isn't 'sensitive':

Prevents content tampering in transit (man-in-the-middle attacks)
Protects users on shared networks and public Wi-Fi
Browser trust and an SEO signal

As important as HTTPS is for serving traffic, the firewall is the network's boundary — read Firewall and Configuration Basics to complete your defense line.

Installing a free certificate with Let's Encrypt

For site administrators:

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com

certbot installs the certificate and sets up automatic renewal; check the renewal status with systemctl status and the timer file.

Settings after installation

Disable TLS 1.0/1.1; keep only versions 1.2 and 1.3 on the server
HSTS: force the browser to always stay on https (a Strict-Transport-Security header with a high max-age)
Redirect everything from http to https, for the domain and the www subdomain
Run a scan with Qualys SSL Labs and keep the rating above A

For users: the last line of defense

Always check the padlock and the domain name in the address bar; https on the wrong domain (like paypa1.org) is just as dangerous as a page without https. On phishing, read Detecting and Defending Against Phishing.