Every request between a user's browser and your app crosses networks you do not control: café Wi-Fi, mobile carriers, internet providers. Without encryption, anyone along that path can read passwords and session tokens or alter the page. TLS prevents this by encrypting the connection and by proving, through a certificate, that the server is really yours.
Hosting platforms such as Vercel, Netlify and Cloudflare provide HTTPS certificates automatically, so the front door is usually fine. The gaps are elsewhere. A page served over HTTPS that calls an API over plain http. A custom domain that still answers on http without redirecting. A database connection string with SSL disabled because the AI tool hit a certificate error and chose the quickest fix. Code that turns off certificate verification to make a request succeed.
Use HTTPS for every page and every API call, redirect http to https, and add an HSTS header so browsers refuse to downgrade. Require TLS on database and cache connections, never disable certificate checks in production code, and mark cookies as Secure so they are only sent over encrypted connections.
curl -I http://yourdomain.com