Web protocols are the communication rules used by browsers and servers, most commonly HTTP and HTTPS. They define how requests, responses, cookies, headers, and encrypted sessions move across the internet. In cybersecurity, these protocols matter because they are legitimate, high-volume channels that attackers can borrow to hide malicious activity inside normal-looking web traffic.
Malware often uses web protocols for command-and-control, data theft, and beaconing because security tools may treat browser-like traffic as routine. An attacker can make a beacon look like ordinary page access by using common ports, standard user-agent strings, and HTTPS encryption. Defenders watch for signs that do not fit normal browsing, such as repeated connections at fixed intervals, unusual domains, non-browser processes making web requests, or destinations that behave unlike real websites. Careful analysis of HTTP and HTTPS patterns helps separate harmless browsing from covert malware communication.