WWW, HTTPS and HTTP: Differences and Setup Basics

1. Two Different Layers in One URL

A full web address has several distinct parts, each doing a different job. Take this example: https://www.yourbrand.com/about

Breaking it down:

• https:// is the protocol – it tells the browser how to communicate with the server.
• www is a subdomain – it identifies which part of the server to connect to.
• Yourbrand.com is the domain itself.
• /about is the path to a specific page within that domain.

HTTPS and www are separate components sitting in different positions within that structure. One is about security, while the other is about addressing.

Since they both appear at the front of a URL and both feel like they're "part of the website address," it can be a bit tricky to delineate between www vs HTTPS as structural or operational parts of resolving a URL. This is especially notable since older browsers typically omitted both parts from the URL box. However, you can have any combination of www or no www and HTTP or HTTPS for your website, depending on how it's configured.

2. HTTP vs HTTPS: What the S Actually Changes

So what's the difference between HTTPS and HTTP? HTTP (an acronym for Hypertext Transfer Protocol) is the foundational set of rules that governs how data moves between a browser and a web server, as defined in RFC 9110. When a browser requests a page over HTTP, data is sent in plain text. Anyone positioned between the user and the server (such as on the same Wi-Fi network) can potentially intercept and read that data. That includes passwords, form submissions, credit card numbers, and session cookies.

With regard to "What does HTTPS mean?," the "S" in HTTPS stands for "secure," an encryption layer using TLS (Transport Layer Security), the modern successor to SSL. Before any data is exchanged, the browser and server perform a handshake that establishes an encrypted connection. After that, everything sent in either direction is scrambled and unreadable to anyone intercepting it.

To enable HTTPS, a website needs an SSL certificate installed on its server. The certificate does two things: it provides the cryptographic keys used to set up the encrypted connection, and it verifies that the server is genuinely operated by who it claims to be. When a browser connects to a site over HTTPS, it checks that the certificate is valid, hasn't expired, and was issued by a trusted Certificate Authority (CA). The entire process is a bit convoluted, but Let's Encrypt has made a comprehensive guide.

When a site loads over HTTPS, modern browsers include a padlock icon in the URL space to specifically note that the connection is secure. Modern browsers also actively flag HTTP-only sites as "Not Secure," particularly when a user begins interacting with a form or entering any information. This warning appears regardless of how innocuous the site's content is.

3. What WWW Means in a Domain

While www (World Wide Web) is technically just a subdomain, it's one in the same way that blog.yourbrand.com or shop.yourbrand.com are subdomains. In the early days of the internet, it was standard practice to serve websites from the www subdomain specifically, while other services (email, FTP, etc.) ran from different subdomains. That convention became so universal that most people came to think of www as a mandatory part of a web address. However, it's simply a label that, by convention, points to the web server.

If you exclude the www part, you get a "root domain" or "apex domain" without any prefix, such as yourbrand.com rather than www.yourbrand.com. With regard to www vs HTTPS, both can serve a website, and both can run over HTTPS. The difference is purely one of address structure. From a user's perspective, both addresses lead to the same site as long as redirects are configured correctly. From a technical perspective, the root domain has slightly more constraints around certain DNS settings, which is one historical reason www persisted.

4. SSL Certificates and Which One You Need

SSL certificates primarily differ in the level of verification the Certificate Authority performs before issuing, but also in how much of your site they cover.

When it comes to the verification level, there are three main types:

• A Domain Validation (DV) certificate confirms that the applicant controls the domain. It's the fastest and most affordable type to obtain. DV certificates enable HTTPS and display the padlock, which is sufficient for most websites, but they technically don't verify the organization behind the domain.
• An Organization Validation (OV) certificate requires the CA to verify the legal existence of the organization applying for it, not just control of the domain. This takes longer and costs more, but the certificate carries verified organization information that can be inspected.
• Extended Validation (EV) certificates involve the most rigorous vetting process, confirming legal registration, operational existence, and physical address. Browsers historically displayed the organization name in a green address bar for EV certificates, though most modern browsers have removed the indicator. EV certificates are still used by banks, financial institutions, and large e-commerce operators.

Beyond this, there are three types of domain coverage:

• A wildcard certificate covers a domain and all of its first-level subdomains under a single certificate. A wildcard for *.yourbrand.com would cover www.yourbrand.com, shop.yourbrand.com, blog.yourbrand.com, and any other subdomain, but not yourbrand.com itself (the root domain), which requires a separate entry. Wildcard certificates are useful for sites with multiple subdomains that would otherwise each require their own certificate.
• A single-domain certificate covers one specific hostname, which is either the www version or the root domain, but not both, unless the certificate includes a Subject Alternative Name (SAN) entry for the other.
• A multi-domain certificate (also called a SAN certificate or UCC certificate) can cover multiple distinct domains and subdomains under a single certificate.

5. Does HTTPS Impact Rankings?

Google started using HTTPS as a ranking signal in 2014, stating explicitly that it would give HTTPS sites a slight edge over equivalent HTTP sites. Today, HTTPS is practically universal among well-maintained websites, meaning that it has become a baseline expectation rather than a differentiator. As such, HTTP is more likely to hurt you than running HTTPS is likely to help you.

6. WWW vs Non-WWW: Which Version Should You Choose?

Google has no preference between the www and non-www versions of a domain. Both are treated as equally valid choices for a canonical URL. The decision is entirely based on your own preferences, technical setup, and any infrastructure requirements.

7. How to Move from HTTP to HTTPS Safely

The first step is obtaining and installing an SSL certificate for your domain. If you're using a managed hosting provider, this may be available as a one-click option through your control panel. If you're managing your own server, you'll need to generate a Certificate Signing Request (CSR), purchase and activate a certificate through a Certificate Authority or your registrar, and install it on the server. Or, you may be in the process of determining how to transfer your domain name to a new host, going from HTTP to HTTPS. With any of these scenarios, once installed, your site becomes accessible over HTTPS. The SSL certificate options at Register.Domains cover the most common certificate types for sites of all sizes.

8. How to Set Redirects and Canonicals Correctly

Once your SSL certificate is installed and HTTPS is working, configure your server to automatically redirect all HTTP requests to their HTTPS equivalents using a 301 (permanent) redirect. This tells browsers and search engines that the move is permanent and transfers link equity from the old HTTP URLs to the new HTTPS ones. Old HTTP URLs may temporarily remain indexed, but the HTTPS version should be re-verified and updated in Google Search Console. Most hosting control panels provide a toggle for this action directly.

Similarly, configure a 301 redirect from your non-preferred version to your preferred version. If your canonical URL is https://yourbrand.com, then https://www.yourbrand.com, http://yourbrand.com, and http://www.yourbrand.com should all redirect there. Most sites need four redirect rules in total to cover all combinations of protocol and subdomain. Test each one after configuration to confirm the chain resolves in a single hop rather than chaining through multiple redirects.

9. Common Redirect Mistakes to Avoid

The most common errors are:

• Using 302 (temporary) redirects instead of 301 (permanent) ones
• Creating redirect chains where HTTP redirects to www, which then redirects to HTTPS
• Leaving the old HTTP sitemap in place rather than updating it to reflect HTTPS URLs
• Leaving the robots.txt file accessible over HTTP and blocking Googlebot from crawling the new version of your site

Secure your site with HTTPS – explore SSL certificate options at Register.Domains and get started today.

10. FAQs