HTTP is an application protocol for communication between client and server. A browser uses it, for example, to load web pages, images, or scripts. Many application programming interfaces and webhooks also transfer information over HTTP.
How a request is structured
A client sends a request with a method, a target, and, if necessary, additional headers and content. The server responds with a status code, headers, and optionally content. GET, for example, requests a representation of a resource; POST submits content for processing.
HTTP is stateless: the meaning of a request can be understood independently of previous requests. Applications can still manage sessions, for example through cookies and sign-in data stored on the server side.
Typical status codes are:
- 200: The request was processed successfully.
- 301 or 308: The target has been moved permanently.
- 404: The requested resource was not found.
- 500: An internal server error occurred during processing.
A status code describes the technical response. It does not automatically confirm that a business transaction was completed correctly in substance.
HTTP and HTTPS
With unencrypted access via the http scheme, data can be read or modified in transit. HTTPS protects the connection with TLS and makes it possible to verify the server's identity using a certificate. The usual default ports are 80 for HTTP and 443 for HTTPS.
However, an encrypted connection guarantees neither the trustworthiness of a website nor that its application is free of errors.
HTTP/1.1, HTTP/2, and HTTP/3
The versions share basic concepts such as methods and status codes but differ in how messages are transported. HTTP/2 transfers multiple data streams over one TCP connection and compresses headers. HTTP/3 uses QUIC with integrated TLS protection. Separate QUIC streams can continue independently of one another when packets are lost.
Operational significance
Companies should use HTTPS, valid certificates, appropriate cache rules, and traceable redirects. After a website migration, old addresses need suitable new targets. Error codes, response times, and failed requests belong in monitoring. For confidential content, sign-in, permissions, and the application itself must also be protected.