Last month we moved our website to a new host server. As part of the move we discovered that we needed to change the security for the site. If you look carefully at the URL when visiting the site you’ll notice that it now has “https” at the beginning instead of “http”.
The “s” at the end indicates there is a level of security on the site that was not present beforehand. Over a year ago Google suggested that they would eventually start marking sites as non-secure if they didn’t follow certain security protocols. (see that announcement here). It included getting a SSL Certificate. (“https” is the acronymn for Hyper-Text Transfer Protocol Secure and “SSL” stands for Secure Socket Layer.) In other words, ours is now a safe site to visit according to Google.
Google also indicated that search results rankings will favor sites with the “https” designation. I found one place that lists 200 factors that go into the rankings. #74 is the security factor.
I make no claim to understand what goes into all of this. Ask your web master. It may involve upgrading your site and may involve some cost.
Before you panic, I’m assured that your existing http site will work just as before. But for some new visitors they may eventually get a red “unsafe” site page without you knowing it. Plus there is a risk of your site ranking sliding from its current position. Since your author web site is an important part of your marketing please look into this soon.
If you can add, clarify, or correct anything please do so in the comments below!
Just when you thought you had all this stuff figured out they change the rules. Next thing you know they’ll move the distance for the extra point kick in football by 15 yards. Oh wait….
I made all those changes (https with SSL) to one of my websites a few months ago and Presto! Chango! My website disappeared from the web. On a weekend. When most people have time to surf. I made a few more changes with no effect. I finally put my old website back and could not access it either. That’s when I finally called my web host. They couldn’t figure it out either and they are one of the largest. Finally they said they could reboot the server. After days I finally had my site back. I’m going to wait until I am forced to change or have plenty of time before I go through all that again because I neither collect personal information nor sell anything on that site.
What? They changed the rules for an extra point conversion in football?
(Adding security on my websites has been on my to do list for most of 2016. Maybe I’ll get to this weekend. Check out https://letsencrypt.org/.)
Hmm, this technical stuff is over my head, but I will definitely get it checked out. Thank you, Steve, for the heads-up.
What kind of a world do we live in, anyway…where neither author websites nor long-held football traditions are safe? Almost makes a girl want to give up. On football, I mean. Who can sit through all those penalties?
Giving up on writing, however, is not an option.
Last night I asked my son about the difference between http and https. I had no idea. And now your article. Wow. Gotta do something about my author site. Thank you for this information.
I’m a writer but I’ve also been an IT professional for almost 17 years. HTTP is hypertext transfer protocol and is the primary communication channel for web traffic. HTTPS is hypertext transfer protocol that communicates over a secure channel and port through the use of a security certificate issued by a trusted Certificate Authority (CA). Which is to say that HTTPS really isn’t a protocol of itself. This is a link to a good article that explains the difference in simple terms -https://www.atlantic.net/community/whatis/http-vs-https/
If anyone has an interest in verifying the status of your site, Google has a number of tools for “Webmasters” that really doesn’t require more than rudimentary Internet skills. Just Google “webmaster tools”, where you can figure out pretty quickly if your site meets the upcoming changes.
These changes are more about the certificate algorithms used more than really the communication protocol (HTTP vs. secure HTTP). For example, SSL was considered the best security standard for many years but now TLS is ranked as superior. Bottom line is your web site hosting company should be able to easily explain all of these things to you and offer the best options for how to make your site secure and still come up in Google rankings. Just be savvy and don’t let them try to sell you the moon.
A good security certificate for your site using the latest TLS v1.0 should be sufficient. Costs can range from $30-80 for 12 months, depending on the web host. Some sites (like WordPress over custom domains) already offer this at no additional charge, so be sure to fully verify before laying out any of your hard-earned cash.
Jon, thank you so much for posting this information! Super helpful!
Kate, my pleasure… glad I could be of help.
Jon,
Thank you for taking the time to explain.
At the very least this conversation can help authors improve their sites and be ready for forthcoming changes.
I still run across sites that are not “responsive” meaning they don’t render very well on different devices (like a phone vs. a monitor). An upgrade is necessary if one’s site is still set up the “old” way.
Steve, you bet. Always a pleasure. And you’re correct, authors need to stay on top of the trends and changes. Responsive and mobile sites are more important than ever. Good Web hosting companies are on top of these things and if not authors should look elsewhere. Anyone is welcome to contact me through my site if they need some recommendations.
Steve, thanks for this information, I didn’t have a clue!
I checked with our programmer about this because the clients we build websites for panicked when Google made this announcement.
In plain English, switching to https is necessary only if your site requires a password for users to log in (for example, you offer an online course that people buy, and they log in to your site to access the course materials) or your site accepts credit card payments (you do e-commerce or have a shopping cart on your site).
I’ll let you know if I hear anything new or different.
Laura,
I wondered about that. But I visit a lot of sites that have no log-in or membership or commerce and they have all seemed to migrate to the https protocol. Thus my article.
I may be wrong in suggesting a nuclear implosion, but I’d rather be already prepared if Google does implement something widespread when it comes to rankings and otherwise in their searches.
We are at the mercy of these mega-corporations that run our digital world.
“In plain English, switching to https is necessary only if your site requires a password for users to log in….”
Hi Laura, technically that’s accurate but I would caution not complete. In the particular instance Steve is talking about as relates to Google, ANY data sent over secure HTTP to or from websites utilizing it is encrypted. So really, if you are sending or receiving any data via a database, for example–which is MOST sites on the Internet today–having your site default to communication utilizing a TLS certificate adds an additional measure of security.
In this day and age, that can’t hurt and in fact it’s only helpful to your customers. It also significant reduces the chances of hackers being able to spoof your site by sniffing IPs and executing what are known as man-in-the-middle attacks.
Steve, this is enlightening. So, and this question is for anyone, is there anything I can/should do if my only site is my blog? I don’t have a website yet, or a web master.
The things you learn here…thank you! I don’t have an author site, just a WordPress.com blog, so thankfully all that is covered. For now.
This is probably more a question for Jon.
When I insert a hyperlink, the http:// or https;// is part of the inserted URL. I’m my own webmaster using WordPress as my CMS. Will I have to go in and edit every hyperlink on my site to add the s to the http’s?
Also, will switching to https break the link to everyone who has already bookmarked to the http version of the site?
Carol,
My answer would be “don’t try to do this at home.”
Many of us know just enough to be dangerous and break everything. I only have a professional deal with these tech issues.
Sort of like being an Indie author and running into contractual difficulties… a professional, like an agent, may have helped avoid those troubles from the beginning.
I am pretty close to a professional when it comes to some computer tasks, Steve. I’ve programmed everything from physics calculations to instrument control to the web pages for a couple of sections of a scientific society in the early 2000’s.
I think you’ll find there are quite a few of us who run our own author websites based on WordPress.org as the content management system. It’s pretty easy to do once you get started, and I save a lot of money doing it since I’m running multiple websites including a blog site and an author website that is a history site that I might update several times a week. That equals $$ and an inconvenient time delay if you hire a webmaster. You can’t fine-tune something on the fly to get it just how you want it.
Doing the flip from http to https would be easy for a simple site. The browsers are pretty smart and will find the https site if a person types in the name with http (I tried it on yours in Chrome), but will that same intelligent conversion be made from links that are embedded in a page, post, or document?
I hope Jon or someone who is an up-to-date expert will comment on that.
I hear you about professional skill being an asset. I would NEVER dream of trying to deal with contractual difficulties myself.
I wasn’t suggesting you weren’t capable. You’ve exhibited mad scientific and tech skills in many of your blog posts!
Here are a couple articles done in the last year about moving from http to https. I have no idea what they mean but you should have no problem deciphering the lingo:
http://searchengineland.com/http-https-seos-guide-securing-website-246940
https://www.keycdn.com/blog/http-to-https/
Thanks! These should be a great starting point.
Mad? Well, I almost never get angry, but I can get passionately fixated on something beyond what a normal person might consider reasonable. Maybe that’s borderline mad.
Definition of the slang term “mad skills”
To be able to do/perform amazing/unexpected things.
“I gots me mad skills, yo.”
To be said after performing an extraordinary feat.
http://www.urbandictionary.com/define.php?term=mad%20skills
I read through both links. They give pretty complete instructions on what to do. They made me want to pull a blanket over my head and scream, “No! I don’t want to do all this!”
But it’s like anything that looks too big and complicated. The way to eat even an elephant is one bite at a time.
How hard can it be? It’s only playing with a bunch of zeros and ones.
(The answer to my original question is,”Yes, you do have to go in and change every one of those links by hand or with a search/replace.” But that’s the least of the nit-picky problems.
Hi Carol: Steve is 100% correct, there’s no point in reinventing the wheel. Your desire to learn and educate yourself is commendable but if you’re not in the business with lots of training and experience, the learning curve can be HIGH! 😉
That said, changing all of the links is usually a waste of your time. Most sites that utilize secure HTTP protocol do so by default, meaning that a good many web hosts will not only automatically redirect any call to HTTP on a secure site to HTTPS (you see this frequently for online shopping and financial sites), they often stop traffic cold over HTTP using a technique called “port blocking.” So fear not!
Again, this is not as much about HTTP vs. HTTPS as it is security certificates.
An ssl really should be free these days.
Also, your search ranking will be influenced be whether or not your site is mobile-friendly, too.
Thank you for the info! “Many of us know just enough to be dangerous and break everything.” That would be me. Look’s like it’s time to talk to a professional!
I just did this on a few websites and found another sad side effect. All the hard earned social share counts disappeared for those blogs. I checked around and confirmed that this is what commonly happens. ref https://mediavidi.com/how-to-switch-to-htttps-and-keep-your-social-share-counts/ . If anyone has found a good work around for this, other than the above link, please post it.