The web is not the internet
People use the two words as if they mean the same. They don't. The internet is the hardware: a worldwide network of networks. The World Wide Web is one service that runs on top of it: pages, joined by links.
| The internet | The World Wide Web | |
|---|---|---|
| What it is | Hardware + rules for moving packets | A collection of pages and files, linked together |
| Started | ARPANET, USA, 1969 | Tim Berners-Lee at CERN (Geneva): proposal 1989, first website 1991 |
| Main protocols | TCP/IP | HTTP and HTTPS, plus HTML for the pages |
| You use it with | Any connected app | A browser (Chrome, Safari, Firefox, Edge) |
Web, or just the internet?
For each one: is it using the web (pages over HTTP in a browser), or the internet without the web?
Why "web"? Each page can link to any other page on any server in the world. Draw the links and you get a tangled web. Berners-Lee's big idea was the hyperlink plus three inventions: HTML, URLs and HTTP. He gave them away free, which is why the web spread so fast.
Reading a URL
A URL (Uniform Resource Locator) is the full address of one thing on the web: a page, an image, a video. Every part has a job. Read it left to right, like a postal address read from country down to flat number.
| Part | Example | Job |
|---|---|---|
| Protocol (scheme) | https:// | Which rules to use. The s means secure: encrypted. |
| Subdomain | www. | One part of the site. Could be news., shop., or nothing. |
| Domain name | bbc | The name the owner registered. |
| Top-level domain (TLD) | .co.uk | Country or type: .uk, .es, .com, .org, .gov.uk, .gob.es |
| Path | /news/technology | Which page or file on that server. Like folders. |
| Query | ?page=2 | Extra information for the page, as name=value. Several are joined with &. |
| Fragment (anchor) | #top | A spot within the page. Never sent to the server. |
The real site is the part just before the TLD. https://www.bbc.co.uk.login-check.com/ is not the BBC: its domain is login-check.com, and "www.bbc.co.uk" is just a subdomain anyone could make. Phishing emails use this trick.
Computers find each other by IP address, not by name. Before anything else, your browser asks DNS to turn www.bbc.co.uk into a number like 151.101.0.81. (Topic 15 covers DNS.)
What happens when you press Enter
The web runs on one simple pattern: the browser (the client) sends a request; the web server sends back a response. The rules for these messages are called HTTP: HyperText Transfer Protocol.
GET /news HTTP/1.1 Host: www.bbc.co.uk User-Agent: Firefox/131 Accept: text/html
HTTP/1.1 200 OK Content-Type: text/html Content-Length: 48213 <!doctype html> <html> …the page… </html>
The method says what you want. GET = "please send me this". POST = "here is some data", e.g. a form you filled in.
Headers are extra lines of information: which site (Host), which browser (User-Agent), what type of file comes back (Content-Type).
The status code is a 3-digit number at the top of every response. Its first digit tells you the kind of answer.
The body is the actual file: HTML, an image, a video chunk. A blank line separates it from the headers.
| Code | Name | Means |
|---|---|---|
| 200 | OK | Here it is. Everything worked. |
| 301 | Moved Permanently | It lives at a new URL now. The browser goes there by itself. |
| 403 | Forbidden | It exists, but you're not allowed to see it. |
| 404 | Not Found | No such page on this server. Often a typo in the path. |
| 500 | Internal Server Error | The server's own code crashed. Not your fault. |
| 503 | Service Unavailable | Too busy or down for maintenance. Try later. |
First digit: 2xx = success. 3xx = go somewhere else. 4xx = you (the client) asked for something wrong. 5xx = the server went wrong.
Build a request, watch the response
Why doesn't the server remember me? HTTP is stateless: every request is handled on its own, as if the server had never seen you. That keeps servers simple and fast. Sites that need to remember you (a basket, a login) use cookies (Step 11).
HTTPS and the padlock
Plain HTTP sends everything as readable text. Anyone on the path (the café Wi-Fi, a router) could read or change it. HTTPS is HTTP sent inside an encrypted tunnel built with TLS (Transport Layer Security).
What the padlock does mean
- Nobody between you and the server can read what you send or get back.
- Nobody can secretly change it on the way.
- The server proved it owns this domain name.
What it does not mean
- That the site is honest. Scam sites get free certificates too.
- That the site is safe from viruses.
- That the domain is the one you meant: paypa1.com can have a padlock.
A server can run many services. A port number says which one you want: HTTP uses port 80, HTTPS uses port 443. You rarely see them because the browser adds them for you.
Both AQA 8525 and OCR J277 expect you to know what HTTP and HTTPS are for, and that HTTPS is encrypted. OCR also asks about the web as clients, servers, DNS and hosting. Neither board asks you to write HTML or CSS at GCSE.
Three languages, three jobs
Every web page is built from three layers. Keeping them separate means you can change how a site looks without touching its content, and the other way round.
Switch the layers on one at a time
Hot Potato
A party game for four players.
How the browser draws a page
HTML: tags, elements and attributes
HTML (HyperText Markup Language) labels each piece of content so the browser knows what it is. A label is a tag in angle brackets. Most come in pairs: an opening tag and a closing tag with a slash.
<h1>Hot Potato</h1> <p>A party game for <strong>four</strong> players.</p> <img src="potato.png" alt="A cartoon potato with a fuse"> <a href="https://example.com">Visit the site</a> <ul> <li>Fast rounds</li> <li>Silly physics</li> </ul>
| Tag | Means | Key attributes |
|---|---|---|
| <h1> … <h6> | Headings: h1 biggest and most important, one per page | |
| <p> | A paragraph | |
| <strong> / <em> | Important (bold) / emphasis (italic) | |
| <a> | A link: the "hyper" in hypertext | href |
| <img> | An image. No closing tag (an empty element) | src, alt, width |
| <ul> <ol> <li> | Bullet list, numbered list, each item | |
| <div> | A box to group things (for CSS layout) | class, id |
| <table> <tr> <td> | Table, row, cell | |
| <form> <input> <button> | Things the user types into or presses | type, name |
Nest tags like boxes inside boxes: close the inner one first. <p><strong>hi</strong></p> is right. <p><strong>hi</p></strong> is wrong. Browsers try to guess what you meant, so mistakes often don't show, until they do.
Page structure: head, body and the DOM tree
A whole HTML page has a fixed skeleton. The head holds information about the page. The body holds what you actually see. The browser turns it into a family tree called the DOM (Document Object Model).
<!doctype html>
<html lang="en-GB">
<head>
<meta charset="utf-8">
<title>Hot Potato</title>
<link rel="stylesheet" href="style.css">
</head>
<body>
<h1>Hot Potato</h1>
<p>A <strong>party</strong> game.</p>
<img src="potato.png" alt="A potato">
</body>
</html>
<!doctype html> tells the browser "this is modern HTML". It's not a tag; it's a notice.
<html lang="en-GB"> is the root: everything else is inside it. lang tells screen readers which accent to use.
<head> is metadata: data about the page. The <title> shows in the browser tab and in search results. <link> loads the CSS file.
<body> is everything drawn on screen.
In the tree, an element inside another is its child. strong is a child of p, which is a child of body. JavaScript finds and changes elements by walking this tree.
Why indent the code? The browser ignores the spaces. Indenting is for people: each level of indent is one level down the tree, so you can see at a glance what is inside what, just like indentation in Python.
CSS: selectors, properties and the box model
CSS (Cascading Style Sheets) is a list of rules. Each rule says: "find these elements, and make them look like this". One CSS file can style every page of a website.
| Selector | Picks | HTML it matches |
|---|---|---|
| p | every element of that type | <p> |
| .warning | every element with that class (dot) | <p class="warning"> |
| #logo | the one element with that id (hash) | <img id="logo"> |
| nav a | any a that is inside a nav | <nav><a> |
| Property | Changes | Example value |
|---|---|---|
| color | text colour (American spelling!) | #C0392B, red, rgb(192,57,43) |
| background-color | colour behind the element | #FFF3D4 |
| font-family / font-size | typeface / text size | Arial / 18px |
| text-align | left, centre or right | center |
| width, padding, border, margin | the box model, below | 200px, 10px, 2px solid black |
Several rules can hit the same element. They cascade like a waterfall: a more specific selector wins (#id beats .class beats p), and if two are equally specific, the later one wins.
The box model
Every element is drawn as a rectangle with four layers, from the inside out.
Box model playground
Hosting, domain names and page weight
To put a site on the web you need two things. Hosting: a web server, a computer that is always on and always connected, to keep your files and send them out. And a domain name, so people can find that server.
| Spain | UK | |
|---|---|---|
| Country TLD | .es | .uk, .co.uk |
| Who runs it (the registry) | Red.es (dominios.es), a Spanish public body | Nominet, a UK not-for-profit company |
| Government | .gob.es (e.g. sede.agenciatributaria.gob.es) | .gov.uk (e.g. www.gov.uk) |
| Universities | .es (e.g. ucm.es) | .ac.uk (e.g. ox.ac.uk) |
Register a domain through a registrar (a shop that sells names). You rent it, usually by the year. Nobody owns a name for ever.
Rent hosting: space on a web server in a data centre, from a hosting company or a cloud provider. Or run your own server, if it can stay on all the time.
Point the name at the server: add a DNS record that says "hotpotato.es → this IP address".
Upload your files (HTML, CSS, images). Now any browser in the world can request them.
A static site sends the same files to everyone, like this study page. A dynamic site runs code on the server (often with a database) to build a fresh page for each person: your Amazon basket, your Instagram feed.
How long does a page take to arrive?
A page's weight is the size of everything it needs: HTML, CSS, scripts, images, fonts. A typical home page today weighs about 2 to 3 MB, mostly images.
A 3 MB page on a 20 Mbps connection. File sizes are in bytes (big B), speeds in bits (small b).
Turn megabytes into megabits: 3 × 8 = 24 megabits. (8 bits in every byte.)
Each second, 20 megabits arrive. How many seconds for 24? 24 ÷ 20 = 1.2 seconds.
Make the page lighter: shrink the images to 1 MB in total. 1 × 8 = 8 megabits. 8 ÷ 20 = 0.4 seconds. Three times faster.
Real pages are a bit slower: each of the dozens of requests has a round-trip delay (latency) before data starts flowing.
Why does page weight matter? On a slow phone connection or a capped data plan, a heavy page costs time and money. Search engines also rank faster pages a little higher.
Search engines: crawl, index, rank
A search engine can't read the whole web when you press Search: that would take years. It does the hard work in advance, in three stages. When you search, you search its index, not the live web.
PageRank: links are votes
Google's first big idea (Larry Page and Sergey Brin, 1998) was PageRank. A link from page X to page Y is a vote for Y. But votes aren't equal: a vote from a popular page counts more, and a page that links to many others splits its vote between them.
Give every page the same score to start: 1 ÷ (number of pages).
Each round, every page shares its score equally among the pages it links to.
A page's new score = a small fixed amount + 0.85 × (the shares it received). The 0.85 is the chance a surfer keeps clicking links instead of typing a new address.
Repeat until the scores stop changing. Pages with many links from high-scoring pages end up on top.
Run a tiny search engine
Six web pages. The crawler starts at page A. Press Next to crawl, then index, then rank. Then search.
Page E repeats "potato" again and again to look relevant. This is keyword stuffing. Ranking by word count alone falls for it; ranking by links doesn't, because nobody important links to E. Real search engines use hundreds of signals and punish tricks like this. SEO (search engine optimisation) done honestly means clear titles, good headings, fast pages and content people want to link to.
Accessibility and cookies
A good website works for everyone, including people who are blind, deaf, dyslexic, colour-blind or can't use a mouse. And it is honest about what it remembers about you.
Accessibility
| Do this | Who it helps | In HTML / CSS |
|---|---|---|
| Alt text on every meaningful image | Blind people using a screen reader, which reads the page aloud | <img alt="Team photo, 4 students holding a trophy"> |
| Strong contrast between text and background | Low vision, bright sunlight, dyslexia | color + background-color |
| Real headings in order (h1, then h2…) | Screen-reader users jump between headings | <h1> <h2> |
| Links that make sense alone | "Download the timetable", not "click here" | <a> |
| Works with a keyboard (Tab, Enter) | People who can't use a mouse | <button>, not a clickable <div> |
| Captions on videos | Deaf people; anyone in a noisy room | <track> |
| Don't use colour alone | Colour-blind people (about 1 in 12 boys) | add a word or icon too |
Contrast checker
Normal text: the quick brown fox.
Large text
The world standard is WCAG (Web Content Accessibility Guidelines). Level AA asks for a contrast ratio of at least 4.5 : 1 for normal text and 3 : 1 for large text. UK: the Equality Act 2010 and, for public bodies like state schools, the Public Sector Bodies Accessibility Regulations 2018. Spain: Real Decreto 1112/2018 for public-sector websites, and Ley 11/2023, which brings in the EU's European Accessibility Act for many businesses from June 2025.
Cookies
A cookie is a small piece of text a website asks your browser to keep, like basket=3items. Your browser sends it back with every request to that site. That's how a stateless protocol remembers you.
| Kind | Used for | Needs your consent? |
|---|---|---|
| Strictly necessary | Keeping you logged in, your basket, remembering you said no to cookies | No |
| Preferences | Language, dark mode | Spain: usually yes. UK: often not, since 2025 (see below) |
| Analytics | Counting visitors to improve the site | Spain: yes. UK: not always, since 2025 (see below) |
| Third-party tracking | Set by an advertiser's domain on many sites, to follow you around the web and target adverts | Yes, in both |
UK: the Privacy and Electronic Communications Regulations (PECR) need consent before storing cookies, except strictly necessary ones. The Data (Use and Access) Act 2025 adds exceptions for some low-risk cookies, such as analytics used only to improve a site, as long as users are told clearly and can object. Spain: article 22.2 of the LSSI (Ley 34/2002) needs informed consent for anything not strictly necessary, and the regulator, the AEPD, says rejecting must be as easy as accepting. Both countries' data-protection laws (UK GDPR / EU GDPR + LOPDGDD) apply when cookies identify a person.
Common mix-ups
The mistakes almost everyone makes at first. Read the left side, then the right.
The web and the internet are the same thing.
The internet is the network. The web is one service on it, alongside email, games and video calls.
A 404 error means the internet is broken.
The server answered fine. It just has no page at that path. Check the URL for typos.
The padlock means the site is safe and honest.
It only means the connection is encrypted and the domain is proven. Scam sites have padlocks too.
HTML is a programming language.
HTML is a markup language: it labels content. No variables, no ifs, no loops. JavaScript is the programming language.
Padding and margin are the same thing.
Padding is inside the border (gets the background colour). Margin is outside (always see-through).
A search engine searches the whole web when you press Enter.
It searches its own index, built earlier by crawlers.
The domain is whatever comes after www.
Read from the right: the registered name is the part just before the TLD. bbc.co.uk.evil.com belongs to evil.com.
Cookies are programs that can spy on your computer.
A cookie is just a small piece of text. It can't run. Tracking comes from many sites sharing one third-party cookie.
Check yourself
Quick questions first. Then endless practice: a wrong answer shows you the working, step by step.