“wss works on both http and https” ??? This is a strange phrase.
wss is secure only because it means “WebSocket protocol over https“. WebSocket protocol itself is not secure. There is no Secure WebSocket protocol, but there are just “WebSocket protocol over http” and “WebSocket protocol over https”. See also this answer.
Read RFC 6455 (The WebSocket Protocol) to reach the right answer. To become a true engineer, don’t avoid reading RFCs. Only searching technical blogs and StackOverflow for answers will never bring you to the right place.