{"id":3397,"date":"2017-01-20T15:17:21","date_gmt":"2017-01-20T20:17:21","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=3397"},"modified":"2018-10-02T05:49:42","modified_gmt":"2018-10-02T09:49:42","slug":"not-secure-2017-time-get-ssl-https","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/not-secure-2017-time-get-ssl-https\/","title":{"rendered":"It\u2019s 2017, Which Means It\u2019s Time to Get SSL"},"content":{"rendered":"

The browsers are done asking politely\u2014time to migrate to HTTPS.<\/h2>\n

For all the websites out there that are still using HTTP, we want to talk about the importance of providing secure connections to your website by migrating to HTTPS before Google Chrome gives you an ugly surprise by slapping a “not secure” label next to your URL in its address bar.<\/p>\n

You likely have heard about HTTPS, which is the secure version of HTTP (the internet communication protocol that is used to \u201ctalk\u201d to websites). You may even know why it\u2019s important, but think that it does not apply to your site. We are here to tell you that in 2017, HTTPS is going to be a requirement for every website on the internet. No exceptions.<\/p>\n

If you have not been keeping up with developments in web standards, you may have missed the initiative that has been emerging over the last few years: the web community is making SSL encryption a baseline security requirement, and it realistically won\u2019t be possible to stay on HTTP much longer.<\/p>\n

We have put together a thorough and up-to-date argument about the benefits of acquiring SSL (and serving your site over HTTPS) and how key internet players (the likes of Google, Mozilla, Microsoft, Apple) have put it at the core of the web.<\/p>\n

If you think adopting HTTPS is still only about adding secure connections to your site, you need to read this:<\/p>\n

Why HTTPS?<\/h2>\n

First, the basics: HTTPS encrypts your visitor\u2019s data and provides integrity, so that the no one can modify or read what\u2019s being sent and received or perform a man-in-the-middle attack. It helps protect you from attackers big and small \u2013 from governments to coffee shop hackers.<\/p>\n

Security is the core purpose of HTTPS. So, while we are excited to tell you about the other benefits (better performance, better SEO) we don\u2019t want you to forget about this one.<\/p>\n

If you are handling any personal information at all \u2013 passwords, addresses, financial data, etc. \u2013 using encryption ensures that the data is securely traveling to your servers without the risk of tampering or theft. You MUST start using encryption if you are collecting this type of data or it\u2019s only a matter of time before your users\u2019 safety will be jeopardized. Any business or organization that has a reputation to maintain (or build) needs to be serving its site over HTTPS to secure its connections and protect communication\u2014a data breach could be devastating to your brand. Per the National cyber security Alliance, 60% of small businesses that suffer a hack or breach end up going under within six months of the incident.<\/p>\n

Secure by Default<\/h2>\n

But HTTPS is not just about protecting personal data. Every byte that travels to and from your server deserves equal protection. We have entered the \u201csecure by default\u201d era \u2013 where security is becoming a core piece of a system\u2019s design instead of an afterthought.<\/p>\n

With evidence of wide-spread internet surveillance<\/a>, governments paying millions of dollars to hack political activists<\/a>, and phishing campaigns hitting everyone<\/a>, it\u2019s no wonder that our industry has realized that security is a necessity and not an option.<\/p>\n

Encryption has gained a ton of traction and adoption since Edward Snowden leaked documents showing just how much of our plaintext internet activity was being monitored and recorded. Major civil liberties advocates<\/a> and privacy groups<\/a> have adopted the call to encrypt the web to protect us from this threat.<\/p>\n

[su_pullquote]\u201c[W]e plan to label all HTTP pages as non-secure.\u201d[\/su_pullquote]<\/p>\n

But encryption isn\u2019t just for protecting yourself from the big bad guys. Comparably benign threats \u2013 like ad injection – can also be stopped by HTTPS. It\u2019s unfortunate, but service providers<\/a> have shown they will modify your webpage<\/a> and abuse your privacy if it\u2019s not protected<\/a>. By providing authenticated connections, HTTPS prevents that sort of network-level tampering on your site. This ensures you can give a consistent experience to your users and that the bytes you are sending are the only ones your visitors receive.<\/p>\n

Finally, when someone connects to your site, it is their data that is being put onto the internet. You should give them the option to keep that data secure by providing encryption. This is particularly relevant in situations where a user may want to keep his or her browser history private. Without HTTPS, it\u2019s easy to track what pages someone was viewing on your site. With HTTPS, some degree of anonymity can be maintained while browsing.<\/p>\n

The Internet of Tomorrow Will Be Encrypted<\/h2>\n

Now, internet giants like Google, Facebook, Mozilla, and the IETF are planning on making sure the future of the internet is using HTTPS. Meaning that soon, unsecure HTTP will become a thing of the past.<\/p>\n

Perhaps the largest reason for this, at least long-term, is that all the major browsers \u2013 Chrome, Firefox, Edge, and Safari \u2013 have decided that HTTP\/2 will only be available to sites that use HTTPS. This major upgrade to the HTTP protocol (the first in nearly two decades) brings huge performance improvements (here is a brief introduction to HTTP\/2<\/a>). For the internet, this jump from HTTP\/1.1 to HTTP\/2 is going to be like upgrading from horse-drawn carriages to motorized cars.<\/p>\n

While it will likely take years, the entire internet will slowly migrate to HTTP\/2. When that does happen, the death of unsecure HTTP will be official. Migrating to HTTPS isn\u2019t a question of \u201cif,\u201d it\u2019s a question of \u201cwhen.\u201d<\/p>\n

We think we have a pretty good case for why 2017 should be the year you adopt HTTPS:<\/p>\n

Insecure Sites Will Be At a Disadvantage<\/h2>\n

So far we have talked about how encryption protects you, and why the internet community is moving towards an HTTPS-only future. But what we haven\u2019t mentioned is that sites that remain on insecure HTTP will be at a competitive disadvantage.<\/p>\n

In order to effectively motivate the millions of websites out there to migrate, there are both incentives for adopting HTTPS, and penalties for failing to.<\/p>\n

The biggest penalty will be coming from Google and Mozilla, who\u2019s Chrome and Firefox browsers- which make up 50% of the browser market<\/a> \u2013 will be warning users when they visit HTTP sites.<\/p>\n

This behavior is already starting<\/strong>.<\/p>\n

Both upcoming releases of Chrome (v56) and Firefox (v51) \u2013 which are due out the last week of January \u2013 will display a warning for any HTTP page that contains a password field or credit card form. Chrome\u2019s warning will be more severe \u2013 on the left-hand side of the address bar it will read \u201cNot Secure.\u201d Firefox will show a broken padlock icon<\/a>.<\/p>\n

\"HTTPS,<\/p>\n

This warning will slowly spread until all HTTP pages display the same “not secure” warning. Google developer Emily Schechter recently published a blog post<\/a>, saying \u201cwe plan to label all HTTP pages as non-secure.\u201d<\/p>\n

As a website owner, you need to seriously consider what the effects of your users seeing that their browser has called your site \u201cNot Secure\u201d will be. We don\u2019t like to cause undue fear, but this is serious and will negatively affect conversation rates, bounce rates, and your users\u2019 confidence.<\/p>\n

In addition, Google has been applying a SEO rankings boost to pages using HTTPS<\/a> since 2014. Some data has shown as much as 5% jump just from this ranking signal.<\/p>\n

On to the benefits of SSL\u2026<\/p>\n

HTTPS is faster than ever<\/h2>\n

TLS is the protocol that powers HTTPS. The next version, TLS 1.3, will be finalized and supported by consumer libraries like OpenSSL this year.<\/p>\n

It\u2019s the first major upgrade to TLS in nearly a decade, and it brings with it a lot of improvements and optimizations. TLS 1.3 will implement new \u201czero round-trip\u201d handshakes, which will make connections faster. In fact, HTTPS can already be faster than HTTP<\/a>, and TLS 1.3 will only broaden its lead.<\/p>\n

The TLS 1.3 designers have also done their own version of spring cleaning \u2013 ridding the new version of aging encryption methods which added more complexity than true security benefits. This means simpler configurations and less blank-staring at huge lists of settings.<\/p>\n

HTTPS is easier than ever<\/h2>\n

Five years ago, developers would have probably winced when asked to set up HTTPS. But today it is a totally different story. HTTPS has gone from an essential yet sidelined technology, to one of the most important aspects of your website.<\/p>\n

Internet giants like Google and Mozilla aren\u2019t just mandating HTTPS with a memo. They are building suites of tools and new browser behaviors to make it easier than ever to get your site migrated to HTTPS.<\/p>\n

Google started by simplifying its security UI<\/a> to make it easier for average users to understand. Then it built a brand new \u201cSecurity\u201d section<\/a> in Chrome\u2019s Developer Tools to make troubleshooting HTTPS painless. Then it worked on open standards like Content Security Policy<\/a> to provide more security.<\/p>\n

Mozilla built a tool that automatically generates secure SSL\/TLS settings<\/a> for your webserver. Facebook built a free tool to monitor Certificate Transparency logs<\/a> to make sure you know when and where certificates are being deployed for your domains.<\/p>\n

After you have your certificate installed, free tools like SSL Labs<\/a> can test your server to make sure everything is working properly.<\/p>\n

There are more benefits than ever<\/h2>\n

There are so many reasons to migrate to HTTPS that it is honestly hard to cover them in one post. Since we have already talked for a while, we are going to give you a rapid-fire bullet-point list. Every single one of these links to a great resource where you can learn more (and to convince your colleagues that migrating is a great idea):<\/p>\n