In 2014 Google made a statement on their Webmaster Central Blog mentioning that Google would start to give a slight ranking boost to secure HTTPS websites using an SSL certificate with a 2048-bit key.
In January 2017 Google mentioned on their Google Security Blog that they had introduced with Chrome Version 56, a “Not Secure” label in the address bar for websites that collect passwords or credit card details.
While this was announced in April 2017 in this official blog post, we notice that a significant number of our users aren’t using an SSL certificate yet.
If your website isn’t using an SSL certificate yet, now is the time to set one up.
As a matter of fact, Google will push their effort further by introducing a dynamic warning to unsecured websites as soon as a user enters data, and on all HTTP pages browsed in Incognito Mode.
This update will come with the Chrome version 62 expected to be released in October 2017.
While not being a drastic penalty, it may still result in a loss in your conversion rates especially on less tech-savvy audiences.
Google keeps moving toward a fully secure web and even gives a slight ranking boost to sites using an SSL certificate, a factor you should absolutely use now that it is within everyone’s reach.
How should you approach the SSL migration? It can seem overwhelming and complicated, so here is a checklist for you to migrate to the HTTPS protocol without any inconvenience.
I) Backup Your Web Hosting Account
It is very important before proceeding to the SSL installations to back up your website in full, database included. You may refer to the backup section of your cPanel Account if you are running cPanel and then download it on your computer. This step is even recommended to do every once in a while in spite of our nightly backup for your shared web hosting account.
II) Check your CDN SSL Specifications
If you are using a Content Delivery Network (such as Cloudflare), read about the specifications and whether they support the HTTPS protocol. It generally involves extra steps in order to make it work.
Cloudflare, for example, provides an SSL certificate along with its CDN; follow its SSL guide to set it up.
If you are using Cloudflare SSLs you can go directly to step III.
III) Install your SSL certificate
At HostStage, if you are running a shared web hosting account, free Let’s Encrypt SSL is already included. If you are on a managed Linux VPS or a cPanel unmanaged VPS, or a cPanel dedicated server you can open a support ticket to have us install this module, and you’ll be able to issue a free Let’s Encrypt SSL certificate within a few clicks.
You can also benefit from premium SSL certificate, which we provide, or from a third-party provider. Their benefits over Let’s Encrypt include issuance speed, extended validation of your organization (EV SSL), compatibility with older devices and browsers (old Android versions, BlackBerry, Sony PS3 / PS4) and yearly renewal.
IV) Update the references in your content
All JavaScript, CSS and absolute image URLs must be called over HTTPS; check that the HTTPS version of each one works in your browser.
For example, let’s assume you are loading Google Fonts from the Google library.
In your website headers, you may have the following link to load your font:
http://fonts.googleapis.com/css?family=Lora
You would need to change it to:
https://fonts.googleapis.com/css?family=Lora
This loads your font over Google’s SSL, which your own HTTPS page requires; otherwise, your page will display warnings.
Here is a non-exhaustive list of references to check:
- Update Images references in absolute URL
- Update social media JavaScript references (Facebook, X/Twitter)
- Update external JavaScript and library references (jQuery)
- Update External or Absolute CSS Pages references
- Update References in content (which could be in the database, WordPress plugins exist for this purpose)
- Update Hreflang Tags
- Update Canonical Tags
The only exception is plain outbound links, which don’t need to be HTTPS because they are not loaded along with your page.
It can indeed be tedious work, and there are ways to automate the process, either through SSH or with the bulk find-and-replace function of an editor such as Notepad++ on Windows or VS Code on macOS. Please note, you would still need to check whether the HTTPS version of your resources is available manually in a web browser in order to be on the safe side.
V) Let’s not Forget your On Site SEO !
After all, you are also here to benefit from a ranking boost from the SSL so it is also important not to neglect the other sides of your on-site SEO.
- Update your Sitemap URLs with the HTTPS version
- Update your Disavow file in Google Search Console, if any
- Update your robots.txt to include your new sitemap(s)
- Add a new property in Google Search Console, Bing Webmaster Tools and Google Analytics, and submit the sitemap URL in Search Console and Bing Webmaster Tools (no need to use the Change of Address tool)
- Update your social Share Count (some WordPress plugins and online guides are available)
- Update your media campaign to use the https version
- Update your old 301 redirects if any to redirect directly to the https version of your website
You can also enable HSTS (HTTP Strict Transport Security) which would optimize your website loading time by forcing the browser to make all its future requests in HTTPS rather than first querying over the HTTP protocol and then being redirected.
To do so, you would just need to add the following in your .htaccess file in your public directory.
Header always set Strict-Transport-Security "max-age=31536000" env=HTTPS
If your website includes subdomains, you may also directly enable HSTS for them as well with the code below instead of the first one:
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
VI) Let’s Put This ONLINE and Fire your HTTPS
If you are using WordPress, you would need to change your base URL from the admin area:
- Click On Settings
- Select General Sub Menu
- Update WordPress Address (URL)
- Update Site Address (URL)
If you are using another CMS such as Joomla, Drupal, Prestashop the steps are similar but differ slightly.
You would need to refer to their online guide in order to update the website main URL.
Then, you would need to 301 redirect the HTTP version over the HTTPS version for which you would need to update your .htaccess and use the code quoted below:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Section : I have heard !?
1) “I have heard that running a https website is slower than http!“
It is indeed a valid concern since the server would be stressed a little more to encrypt the data of your web page. Now, if you are using our services, you wouldn’t need to worry at all on this matter. We saw it coming and we have taken silent steps to prevent any overload or significant performance loss. All our Linux VPS plans run on NVMe SSD storage. Our shared web hosting servers have all been migrated to LiteSpeed, a better-performing Apache replacement.
2) “I have heard that Let’s Encrypt needs to be renewed every 3 months!“
Correct here again! Except that at HostStage, Let’s Encrypt renewals will be done automatically in due time without any SSL downtime. So there is nothing for you to worry about.
3) “I have heard that I must pay for SSL!“
Yes, that used to be the case, and you still can if you opt for a premium SSL certificate (starting from $10.99 per year). But the Let’s Encrypt initiative remains completely free and we do not charge anything for you to benefit from it. On your web hosting account, the feature is already there.
