HTTP sends data between the browser and the server in plain text, so anyone positioned in between can read or change it. HTTPS is the same protocol wrapped in TLS encryption, which keeps the traffic private and verifies the server's identity. Any app handling logins or personal data should serve every page and request over HTTPS.
What HTTPS actually protects
It does two things: it encrypts the connection so passwords, tokens, and data cannot be read in transit, and it authenticates the server through a certificate so you know you are talking to the real site and not an impostor. Over plain HTTP, a network attacker can read cookies and inject content.
HTTPS-only, not HTTPS-optional
Serving both leaves a gap: a single HTTP request can leak a session cookie or be intercepted. Redirect all HTTP to HTTPS, send the HSTS header so browsers refuse to downgrade, and mark cookies secure so they are never sent over plain HTTP.
What this means for AI-generated code
Generated code sometimes hardcodes an http:// URL for an internal call or API, or configures a service without forcing HTTPS, because it works in local development. That plain-text hop can ship to production unnoticed.