HTTP (Hyper Text Transfer Protocol) is the means by which your web browser (for example, Google Chrome, Microsoft Edge, Firefox, Safari etc.) communicates with a website you are visiting. HTTPS (Hyper Text Transfer Protocol Secure) is basically an HTTP connection that is secure because any information (for example, if you complete an enquiry form or purchase goods on the website) that is transferred between your web browser and the website is encrypted and can’t be intercepted by hackers.
How is the information encrypted?
HTTPS uses special security technology that creates an encrypted link between a server (such as that hosting the website you are visiting) and the “client” (in this case your web browser), but the link could also be between a mail server and mail client such as Outlook. This security technology is provided by Transport Layer Security (TLS) or its predecessor Secure Sockets Layer (SSL), although both are generally referred to as SSL.
What is an SSL Certificate?
An SSL Certificate is a digital certificate that authenticates the identity of a website and encrypts information sent to the server using SSL technology. An SSL Certificate connects a domain, server or host name with the organisation’s identity (business name) and location. It is installed on the web server hosting the business’ website where its function is to establish a secure session with browsers so that all traffic between the website server and the web browser will be secure.
Is it obvious if a website has an SSL Certificate?
Yes, all the major browsers show a closed padlock in the browser bar when you are connected to a website via a secure connection, and the website’s URL will be prefixed by https:// (for example, https://www.fionastorey.uk). If you are not connected via a secure connection the browser bar will indicate this, for example, showing a padlock with a red line through it (Firefox) or the words”Not secure” (Google Chrome).
Who needs SSL?
If you take payments or collect any sensitive data directly via your website you should definitely have an SSL Certificate on your web server and your website should be converted from HTTP to HTTPS. This is also the case for websites having login facilities for access to any part of the website. However, even if you don’t take payments or collect such information it will be beneficial to convert your website to HTTPS:
- For search engine optimisation. Google and other search engines do now penalise sites that are not HTTPS and your ranking in searches will be affected. (For more information read article on “Google Says Switch to HTTPS or Lose Rankings”).
- Trust. Even if they don’t understand the technology behind it, most potential visitors to your website will understand that it is safer to visit a secure site than a non-secure site and that information flowing between their computer and your website cannot be tampered with.
- Speed. HTTPS will make your website faster for almost all of your visitors.
- Your reputation. The red line through the padlock or a notice saying “Not secure” suggests apathy on behalf of the site owner and a lack of care when it comes to their property. This might ultimately be a deal-breaker when it comes to choosing a supplier.
What do you need to do to convert your website to HTTPS?
Firstly you need to obtain an SSL Certificate or ensure that one is installed on your website server. This is done through your website hosting company and you should be able to set it up via your hosting control panel. In many cases an SSL Certificate is included free of charge as part of the hosting package (we include free SSL Certificates in all our web hosting packages). Other hosting companies charge an annual fee for providing the certificate.
Once you have a valid SSL Certificate on your website you need to change the address of your website from http://______ to https://______. As well as the pages and posts, it is important that all internal links (e.g. to images or downloads that are uploaded to your website) are changed as any remaining http links will cause the browser bar to show mixed content. How you do this will depend on the platform on which it is built. On WordPress, for example, there are a range of free plugins available (we use either Easy HTTPS (SSL) Redirection or Really Simple SSL ). NB Make sure you backup your website converting it to HTTPS! We use Blog Vault.
Finally, search engines such as Google will have cached pages and other content as http and not https. If someone clicks through to your website from search results they may get a non-secure connection. To avoid this, force the search engines to index the HTTPS version of your website. You may also be able to force SSL connections for all your visitors by changing a setting in your hosting control panel.
What about Extended Validation SSL Certificates?
You may also have heard Extended Validation (EV) SSL Certificates mentioned. These are used for HTTPS websites and software to prove the identity of the legal entity controlling the website or software package. Obtaining an EV SSL Certificate requires verification of that organisation’s identity by a certificate authority. Web browsers show the verified legal identity prominently in their user interface, either before, or instead of, the domain name. If you install software from a manufacturer that has an EV SSL Certificate, the verified legal identity will be displayed to you by the operating system (e.g., Microsoft Windows) before proceeding with the installation. An EV Certificate does not enhance the security of a data transmitted between a website and browser over and above a standard SSL Certificate.
When should an Extended Validation SSL Certificate be used?
EV SSL Certificates should be used for websites where identity assurance and visible trust is particularly important. High profile websites, such as major brands, banks or financial institutions, that are likely to be targeted for phishing attacks, should always have an EV SSL Certificate. However, any website that collects data or handles logins or online payments may also benefit from the greater trust provided by this higher level of SSL.
How can we help?
We offer a service for converting HTTP WordPress websites to HTTPS. We can also provide a quotation for transferring the hosting of your website to Hosting by Fiona Storey. For more information please enquire here.
