What Is HTTP? How the World Wide Web Works

Every web page you visit uses HTTP. Learn how requests and responses work, what methods and status codes mean, and how HTTP evolved from 1.1 to HTTP/3.

What Is HTTP?

HTTP (HyperText Transfer protocol) is the foundation of data communication on the World Wide Web. Every time you open a web page, your browser sends an HTTP request to a web server, and the server sends back an HTTP response containing the page content.

HTTP is a stateless, text-based application-layer protocol. Stateless means each request is independent — the server does not remember previous requests unless you add a mechanism like cookies or sessions.

The Request-Response Cycle

Browser (Client)          Web Server
     |                        |
     |--- GET /index.html --> |
     |                        |
     |<-- 200 OK + HTML ----- |
     |                        |
  1. You type HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe)://example.com into your browser
  2. DNS resolves the domain-kerberos-directory-services-explained) to an [IP address](/learning-center/what-is-an-ip-address-IPv4-and-addressing-explained)-ipv6-and-addressing-explained)
  3. A TCP-the-internets-core-protocol) connection is established (and TLS for HTTPS-tls-how-https-keeps-your-data-safe))
  4. Your browser sends an HTTP GET request
  5. The server responds with a 200 OK and the HTML content
  6. Your browser renders the page

Anatomy of an HTTP Request

GET /products?category=phones HTTP/1.1
Host: shop.example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: text/html,application/xhtml+xml
Accept-Language: en-GB,en;q=0.9
Cookie: session_id=abc123; theme=dark
  • Method — what action to perform (GET, POST, etc.)
  • Path — the resource being requested (/products)
  • Query string — optional parameters (?category=phones)
  • Headers — metadata about the request (browser, cookies, accepted formats)
  • Body — optional data sent with the request (used in POST/PUT)

HTTP Methods

| Method | Purpose | Has Body? | |---|---|---| | GET | Retrieve a resource | No | | POST | Submit data to create/process something | Yes | | PUT | Replace a resource entirely | Yes | | PATCH | Update part of a resource | Yes | | DELETE | Remove a resource | Sometimes | | HEAD | Like GET but returns only headers (no body) | No | | OPTIONS | Ask the server what methods are supported | No |

GET requests are idempotent — making the same GET request multiple times has the same effect. POST requests are not idempotent — submitting a form twice might create two records.

HTTP Status Codes

The server responds with a three-digit status code:

2xx — Success

| Code | Meaning | |---|---| | 200 OK | Request succeeded | | 201 Created | Resource was created (e.g., after POST) | | 204 No Content | Success, but no body to return |

3xx — Redirection

| Code | Meaning | |---|---| | 301 Moved Permanently | Resource has a new URL | | 302 Found | Temporary redirect | | 304 Not Modified | Cached version is still valid |

4xx — Client Errors

| Code | Meaning | |---|---| | 400 Bad Request | Malformed request | | 401 Unauthorized | Authentication required | | 403 Forbidden | Authenticated but not permitted | | 404 Not Found | Resource does not exist | | 429 Too Many Requests | Rate limit exceeded |

5xx — Server Errors

| Code | Meaning | |---|---| | 500 Internal Server Error | Generic server failure | | 502 Bad Gateway | Upstream server returned invalid response | | 503 Service Unavailable | Server is overloaded or down for maintenance |

HTTP Headers

Headers carry metadata. Common ones:

| Header | Direction | Purpose | |---|---|---| | Content-Type | Both | Media type of the body (text/html, application/json) | | Authorization | Request | Authentication token (Bearer, Basic) | | Cache-Control | Both | How long to cache the response | | Set-Cookie | Response | Ask the browser to store a cookie | | Cookie | Request | Send stored cookies back to the server | | Location | Response | Where to redirect (used with 3xx codes) | | X-Frame-Options-HSTS-explained)-csp-hsts-explained) | Response | Prevent page from being embedded in an iframe |

Cookies and Sessions

HTTP is stateless, but web apps need to remember users between requests. Cookies solve this:

  1. Server sends a Set-Cookie header with a session identifier
  2. Browser stores the cookie
  3. Every subsequent request sends the cookie back automatically
  4. Server looks up the session ID in its session store to identify the user

Security attributes for cookies:

  • HttpOnly — JavaScript cannot read the cookie (prevents XSS theft)
  • Secure — Cookie only sent over HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe)
  • SameSite-cross-site-request-forgery-explained)=Strict — Prevents cross-site request forgery (CSRF)

HTTP vs HTTPS

| | HTTP | HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) | |---|---|---| | port-the-internets-core-protocol)-and-UDP-ports-explained) | 80 | 443 | | encryption | None | TLS | | Authentication | None | Server certificate-certificates-and-PKI-explained) verified | | Integrity | None | Tamper-evident |

HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) is HTTP wrapped in a TLS layer. The HTTP messages themselves look identical — TLS just encrypts the entire conversation so eavesdroppers see only ciphertext.

Evolution: HTTP/1.1 to HTTP/3

HTTP/1.1 (1997)

  • One request per TCP-the-internets-core-protocol) connection at a time (head-of-line blocking)
  • Multiple connections opened in parallel as a workaround
  • Text-based headers (verbose, repeated on every request)

HTTP/2 (2015)

  • Multiplexing — multiple requests over a single TCP-the-internets-core-protocol) connection simultaneously
  • Header compression (HPACK) — reduces overhead
  • Server push — server can send resources before the client asks
  • Binary framing instead of text

HTTP/3 (2022+)

  • Replaces TCP-the-internets-core-protocol) with QUIC (built on UDP)
  • Eliminates TCP-the-internets-core-protocol)-level head-of-line blocking entirely
  • Faster connection setup (0-RTT or 1-RTT)
  • Better performance on lossy mobile networks

Related Protocols

| protocol | port-the-internets-core-protocol)-and-UDP-ports-explained) | Purpose | |---|---|---| | FTP | 21 | File transfer (insecure — use SFTP instead) | | SMTP | 25/587 | Sending email | | IMAP | 143/993 | Reading email | | WebSocket | 80/443 | Full-duplex real-time communication |

HTTP in Security

HTTP without TLS is dangerous in any public environment — an attacker on the same network can read your requests and responses. Always use HTTPS-tls-how-https-keeps-your-data-safe) in production. The HSTS-hsts-explained) (HTTP Strict Transport Security-csp-hsts-explained)) header forces browsers to always use HTTPS for a domain-kerberos-directory-services-explained).

Summary

  • HTTP is the request-response protocol that powers the web
  • Every request includes a method, path, headers, and optionally a body
  • Status codes communicate success, redirection, client errors, and server errors
  • Cookies provide stateful sessions on top of the stateless HTTP protocol
  • HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) = HTTP + TLS [encryption](/learning-center/what-is-encryption-symmetric-vs-asymmetric) — always use it in production
  • HTTP has evolved from 1.1 to HTTP/2 (multiplexing) and HTTP/3 (QUIC/UDP)