What does HTTP stand for?

HTTP stands for Hypertext Transfer Protocol. The name reflects its original use of moving hypertext documents, though it now carries images, API data, video and other content.

HTTP defines how a client asks a server for a resource and how the server replies. It sets the format of methods, headers, status codes and bodies so browsers, applications and APIs can exchange data.

Where is HTTP in the OSI model?

HTTP operates at the application layer, layer 7 of the OSI model. It relies on lower layers such as TCP or QUIC and IP to move its messages.

What is the purpose of Hypertext Transfer Protocol?

Its purpose is to provide a common, standardized way to request and deliver web resources between clients and servers. This lets any compliant browser, proxy or server interoperate.

Is HTTP the same as the web?

No. HTTP is one protocol used by the web, alongside URLs and HTML. It is also widely used outside browsers, for example by REST APIs and software update services.

Glossary
What is Hypertext Transfer Protocol (HTTP)?

Security glossary

What is Hypertext Transfer Protocol (HTTP)?

Hypertext Transfer Protocol (HTTP) is an application-layer protocol that lets clients such as web browsers and API consumers request and receive resources from servers. It works as a stateless request and response exchange, carried over TCP in HTTP/1.1 and HTTP/2 and over QUIC in HTTP/3.

Let's simplify your DDI

Abstract isometric UI showing network ranges, usage bars, region names (EMEA/APAC), and a purple "Deploy" button

Key takeaways

Hypertext Transfer Protocol (HTTP) is an application-layer protocol defined in RFC 9110 that enables clients and servers to exchange web resources through stateless request-response cycles over TCP (port 80), QUIC, or encrypted TLS connections. The protocol carries most web and API traffic, making its behavior critical to application performance, availability, and security; misconfigured redirects, caching, and timeouts can degrade applications even when underlying network infrastructure is healthy. Plain HTTP transmits data without encryption, exposing credentials and session cookies to network eavesdropping, while HTTPS addresses this vulnerability by wrapping HTTP messages inside a TLS connection that provides encryption, integrity protection, and server authentication.

HTTP/2 and HTTP/3 multiplex multiple exchanges over a single connection while maintaining standard request-response semantics, improving efficiency compared to HTTP/1.1’s sequential communication model.
DNS resolution, TCP or QUIC connection establishment, and TLS handshake (for HTTPS) are prerequisite steps that must complete before the client can send an HTTP request method such as GET or POST.
Common operational failures including redirect loops, gateway timeouts, stale cached content, mixed content blocking, and incorrect client address logging require careful configuration of proxies, load balancers, cache headers, and header parsing to prevent application disruption.

HTTP at a glance

Attribute	Value
Full name	Hypertext Transfer Protocol
Category	Network protocol
Defined in	RFC 9110 (HTTP semantics), with version-specific specifications in RFC 9112 (HTTP/1.1), RFC 9113 (HTTP/2) and RFC 9114 (HTTP/3)
Protocol and port	TCP port 80 by default for HTTP; HTTP/3 runs over QUIC, which uses UDP
OSI layer	Layer 7 (application)
Primary use	Transferring web pages, API data and other resources between clients and servers
Related terms	HTTPS, TLS, DNS over HTTPS, URL, TCP

How HTTP works

HTTP is a stateless request and response protocol. A client sends a request that names a resource and an action, and the server returns a response with a status code and, usually, content.

Resolve the host name: The client uses DNS to translate the host name in the URL into an IP address.
Open a connection: The client opens a TCP connection to the server, on port 80 by default. HTTP/3 uses a QUIC connection instead. For HTTPS, a TLS handshake follows.
Send the request: The client sends a method such as GET or POST, the target path, headers and an optional body.
Process the request: The server interprets the method and headers, then locates or generates the requested resource.
Return the response: The server replies with a status code such as 200 or 404, response headers and usually a body. The client then renders the content or hands the data to an application.

Each request is independent, so servers do not retain client state between requests unless cookies or tokens carry it. HTTP/2 and HTTP/3 multiplex several exchanges over one connection, while keeping the same request and response semantics.

Why HTTP matters in enterprise networks

HTTP carries most web and API traffic, so its behavior affects application performance, availability and troubleshooting. Status codes, response times and header data are common inputs for monitoring, load balancing and incident response. Misconfigured redirects, caching or timeouts can slow or break applications even when the network underneath is healthy.

Plain HTTP sends requests and responses without encryption. Anyone on the network path can read or alter the content, including credentials and session cookies. HTTPS addresses this by running HTTP inside a TLS connection, which provides encryption and server authentication. Standards also define HTTP Strict Transport Security in RFC 6797, which tells browsers to use only HTTPS for a given site.

Because HTTP is allowed through most firewalls, it is also a common channel for malware command traffic and data exfiltration, and for attacks on web applications. Network teams therefore log and inspect HTTP and HTTPS traffic where policy allows. Weak controls, such as expired certificates or unmanaged plain HTTP endpoints, lead to browser warnings, failed API calls and exposed data.

HTTP vs HTTPS

HTTP sends messages in cleartext, while HTTPS carries the same HTTP messages inside a TLS connection that adds encryption, integrity protection and server authentication.

Attribute	HTTP	HTTPS
Encryption	None; content is readable on the network path	Encrypted by TLS
Default port	80	443
Setup cost	TCP handshake only for HTTP/1.1	Adds a TLS handshake

HTTP vs DNS over HTTPS

HTTP is a general application protocol for requesting web resources, while DNS over HTTPS uses HTTPS as a transport to carry DNS queries and responses. What is DNS over HTTPS?

Attribute	HTTP	DNS over HTTPS
Purpose	Retrieve web pages and API data	Resolve DNS names privately
Payload	Web content and API messages	DNS queries and answers
Encryption	Only when used as HTTPS	Always, through HTTPS

Common HTTP issues

A browser reports too many redirects when a server redirects HTTP to HTTPS and a proxy or load balancer terminates TLS and forwards plain HTTP back to the origin. The origin never sees the request as secure and redirects again.

Clients receive 502 or 504 responses when a proxy or load balancer cannot get a timely answer from a backend. Common causes are mismatched idle timeouts, exhausted backend connections and slow upstream DNS resolution.

Users see old pages or API data after a deployment because cache headers allow browsers or intermediate caches to reuse responses. Overly long max-age values and missing validators are typical causes.

A page served over HTTPS that loads scripts or images over plain HTTP is partly blocked by browsers, so features break while the page itself loads. Hardcoded http links and missing redirects are the usual cause.

Backend logs show the proxy address instead of the real client when the X-Forwarded-For header is not set, not trusted or not parsed. This breaks rate limiting, access control and incident investigation.

See how unified DDI simplifies network operations

Manage DNS, DHCP and IP addresses from one platform with automation, visibility and control built in.

Talk to us

HTTP FAQ

Related terms

Article

Transport layer security (TLS)

TLS (transport layer security) is a cryptographic protocol that provides communications security over a computer network.

Learn more

Article

DNS – Domain Name System

The Domain Name System (DNS) is a hierarchical naming system that resolves domain names to IP addresses, enabling communication across network devices.

Learn more

Article

DNS over HTTPS (DoH)

DNS over HTTPS (DoH) encrypts DNS queries and responses by transmitting them over HTTPS, protecting DNS traffic from interception and monitoring.

Learn more

Article

Transmission Control Protocol (TCP)

Transmission Control Protocol (TCP) is a connection-oriented communication protocol that ensures data is transmitted reliably and in the correct order between devices across an IP network.

Article

OSI model

The OSI model is a conceptual model that characterizes and standardizes communication functions of telecommunications or computing systems.

Learn more

Article

Fully Qualified Domain Name (FQDN)

A Fully Qualified Domain Name (FQDN) is a domain name that specifies its exact location in the DNS tree hierarchy.

Learn more

Article

SSL (secure sockets layer)

SSL (secure sockets layer) is a security technology for establishing an encrypted link between a server and a client.

Learn more

Article

Time to Live (TTL)

TTL (time to live) is a setting for each DNS record that specifies how long a resolver caches the DNS query before it expires.

Learn more

Browse the full glossary

Unlock $120K+ in network ROI

What is Hypertext Transfer Protocol (HTTP)?

Hypertext Transfer Protocol (HTTP) is an application-layer protocol that lets clients such as web browsers and API consumers request and receive resources from servers. It works as a stateless request and response exchange, carried over TCP in HTTP/1.1 and HTTP/2 and over QUIC in HTTP/3.

Ready to simplify your DDI?

HTTP at a glance

How HTTP works