What Is HTTP and How Does It Work?
HTTP is the language browsers use to talk to servers. Every page you open, every form you submit and every image that loads is an HTTP request. Here is what HTTP is in plain English: how the exchange works, what those familiar 404s and GETs mean, and why plain HTTP has all but disappeared.
Request and response
HTTP is about as simple as it gets: the client asks, the server answers. The server has no initiative of its own and never sends anything unprompted.
A request is a method, an address and some headers:
GET /wiki/what-is-http HTTP/1.1
Host: proximamp.com
Accept-Language: en
A response is a status code, headers and a body — the page itself:
HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
<!doctype html>…
One page is rarely one request. It is usually dozens: the HTML first, then stylesheets, scripts, fonts and images, each fetched separately.
Methods
The method states what you want to do with the resource:
| Method | What it means |
|---|---|
GET | Give me this — opening a page, loading an image |
POST | Take this data — submitting a form, creating a record |
PUT / PATCH | Replace / modify something that exists |
DELETE | Remove it |
HEAD | Headers only, no body |
GET and HEAD are considered safe: they change nothing. The rest alter state on the server — which is why your browser asks for confirmation when you reload a page you reached through a POST.
Status codes
Three digits at the start of the response. The first one sets the class:
| Class | Meaning | Familiar examples |
|---|---|---|
2xx | Success | 200 OK, 201 Created |
3xx | Redirection | 301 permanent, 302 temporary, 304 not modified |
4xx | Client error | 404 not found, 403 forbidden, 401 authentication required |
5xx | Server error | 500 internal error, 502 bad gateway, 504 timeout |
The rule of thumb: 4xx is a problem with the question, 5xx is a problem with the answer.
What HTTP runs on
HTTP is an application-level protocol: it describes what is being sent, while delivery is handled a layer below. Usually that is TCP, since a page has to arrive complete and in order. The exception is HTTP/3, which runs over UDP by way of QUIC.
Standard ports:
- 80 — HTTP;
- 443 — HTTPS;
- 3000, 5173, 8000, 8080 — the usual local dev server ports.
You can leave the port out of the address when it is the standard one: http://example.com and http://example.com:80 are the same thing.
HTTP does not remember you
Every request stands alone: by default the server has no idea you were here a minute ago. Cookies, tokens and the Authorization header exist to tie requests into a session — all of them built on top of a protocol that remembers nothing by itself.
Why plain HTTP is nearly gone
Ordinary HTTP sends everything in clear text. Anyone along the way — your ISP, whoever runs that café Wi-Fi — can read the URLs you visit, the contents of forms and your cookies, and tamper with responses if they feel like it.
So browsers moved on: HTTP pages get flagged as Not secure, camera, geolocation and service workers are blocked on them, and search engines factor HTTPS into ranking. These days unencrypted HTTP survives mostly inside your own machine — and only until something needs to reach it from outside.
What HTTPS adds is covered in What is HTTPS.
FAQ
Are HTTP and HTML the same thing? No. HTML is the markup language of the page; HTTP is how it gets delivered.
What are headers? Service lines carrying details about the request or response: content type, language, cookies, caching rules.
Why port 8080? It is simply "alternative HTTP": ports below 1024 need elevated privileges, so development tends to use higher numbers.
Are HTTP/2 and HTTP/3 different protocols? Same methods and status codes, different transport: less latency and multiple requests over one connection.
Serving your local site over HTTPS
Your dev server speaks plain HTTP on localhost. You can publish it over HTTPS straight away, with a valid certificate and no changes to the application — see How to share localhost over HTTPS.