Why is PHP's "SERVER_PROTOCOL" showing HTTP/1.1 even when using https?

Question

The addressbar shows "https://mywebsite.com" and it shows a lock icon (and clicking on that shows it's AES-256), but when I run the following code, it always prints "HTTP/1.1".

echo $_SERVER[ "SERVER_PROTOCOL" ];

Why doesn't this show https?

Answer 1

SERVER_PROTOCOL has nothing to do with the security of your page, it reports if the connections used are HTTP 1.0 or HTTP 1.1 or HTTP 2.0:

http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol

HTTP/1.1 is a revision of the original HTTP (HTTP/1.0). In HTTP/1.0 a separate connection to the same server is made for every resource request. HTTP/1.1 can reuse a connection multiple times to download images, scripts, stylesheets et cetera after the page has been delivered. HTTP/1.1 communications therefore experience less latency as the establishment of TCP connections presents considerable overhead.

While HTTP 2.0 is the next generation of HTTP that allows multiplexing of multiple HTTP 1.1 connections inside one HTTP 2.0 connection.

For your purposes, check if the HTTPS server variable is set:

http://php.net/manual/en/reserved.variables.server.php

i.e. something like

if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') { ... }