Editorial · August 11, 2014
HTTPS small business websites: why to switch now
HTTPS small business websites protect what visitors type into a form, such as a sign-up or an order, while it travels over the internet. On August 6, 2014, Google said it is starting to use HTTPS as a ranking signal. For now, Google calls that signal "very lightweight," so our editors think privacy and trust are the stronger reasons to switch.
What HTTPS does for your visitors
Google's help article says that with HTTPS, information is secured by Transport Layer Security (TLS), which gives three layers of protection. Encryption keeps the data exchanged safe from eavesdroppers. Data integrity means the data cannot be changed or damaged during transfer without being detected. Authentication proves that visitors are talking to the site they meant to reach.
A site that uses HTTPS needs a security certificate, which a certificate authority issues. The Department of Homeland Security's US-CERT says a valid certificate means the authority has taken steps to check that the web address really belongs to the organization that holds the certificate.
US-CERT says a closed padlock in the browser and an address that begins with "https:" indicate that a site uses encryption. If a certificate has expired or its name does not match the site, the browser may show an error. US-CERT advises visitors who are unsure whether a certificate is valid, or who question a site's security, not to submit personal information.
What Google said on August 6
Google said it had spent the past few months running tests that took into account whether sites use secure, encrypted connections as a signal in its search ranking algorithms. The tests gave "positive results," so Google is "starting to use HTTPS as a ranking signal."
For now, Google said, HTTPS is "only a very lightweight signal," while Google gives website owners time to switch. The signal affects fewer than 1% of global queries and carries less weight than other signals, such as high-quality content. Google said it may strengthen the signal over time, because it wants to encourage all website owners to switch from HTTP to HTTPS. At its Google I/O event a few months earlier, Google had called for "HTTPS everywhere" on the web.
Our editors read the signal as a nudge. Switch for your visitors first, and count any search gain as a bonus.
What a certificate costs in money and effort
GoDaddy and Namecheap sell website certificates as "SSL certificates," and Google's help article calls them security certificates. On its SSL page in June 2014, GoDaddy listed certificates starting at $69.99 a year for one website. Its certificates for multiple domains started at $134.99 a year, and its wildcard certificate for all subdomains started at $269.99 a year. Namecheap's page in August listed certificates "as low as $7.95/year."
Namecheap says domain-validated certificates, the most basic type, "are issued very quickly and involve a simple check to verify domain ownership." They are generally the least expensive, it adds. The site Is TLS Fast Yet?, which Google's post links to, says free certificates exist for non-commercial use. For commercial use, it says you can get a single-domain certificate for about $10, a multi-domain certificate for about $30 and a wildcard for about $100. The site gives no time period for these prices.
Google's help article gives this advice for the certificate. Get the certificate from a reliable authority that offers technical support. Choose a 2048-bit key. Decide the kind of certificate you need: single, multi-domain or wildcard. GoDaddy says that after purchase it takes about 10 to 15 minutes to request the certificate. GoDaddy then verifies the request.
How to move your site to HTTPS
Google's site-move guide counts a switch from HTTP to HTTPS as one kind of site move. Our editors picked steps from that guide and from Google's help article and put them in this order. Share the list with whoever builds your site.
- Get and configure the certificate on your server, then test the new site thoroughly.
- Only embed HTTPS content on HTTPS pages.
- Use relative URLs (addresses without the domain name) for resources on your own secure domain. For other domains, use protocol-relative URLs (addresses that start with // instead of http: or https:) or link straight to the HTTPS version.
- Update the pages. Give each new page a self-referencing canonical tag, point internal links at the new URLs, and make one sitemap of the old URLs and one of the new URLs.
- Do not block the HTTPS site in robots.txt, and avoid the noindex meta tag.
- Verify every version of your site in Google Webmaster Tools, with and without www, on HTTP and on HTTPS.
- Redirect each old page to its HTTPS address with a server-side 301 redirect. Avoid chains of redirects.
- Watch traffic, crawl errors and server logs. Keep the redirects as long as possible.
Google also advises moving all URLs at once. It says that, as a general rule, a medium-sized site can take a few weeks for most pages to move, and that visibility in search may fluctuate temporarily during the move. That fluctuation is normal, Google says, and a site's rankings will settle down over time.
Mistakes to avoid
Google's help article lists common pitfalls. Our editors picked three and put them in plain words:
- An expired certificate. Google says to make sure a certificate is always up to date, and US-CERT says most certificates are issued for one or two years. Our tip: note the renewal date.
- A certificate for the wrong name. Google's example is a certificate for www.example.com on a site set up as example.com, which causes a name mismatch error.
- Old TLS software. Google says old OpenSSL versions are vulnerable, so make sure you have the latest TLS libraries. Our tip: ask your web host whether it keeps its TLS libraries current.
If speed worries you, Google's post suggests a look at Is TLS Fast Yet? That site cites Adam Langley of Google, who wrote that SSL/TLS accounts for less than 1% of the CPU load and less than 2% of network overhead on Google's production front-end machines.