<\/span> When HTTP\/2 was finalized in 2015 it was the first upgrade to the HTTP protocol in more than a decade. It brought loads of improvements \u2013 multiplexing<\/a>, server push, header compression, and ditched the need to set up multiple TCP connections. Sounds great, right? So you should make sure your website is using HTTP\/2 since it\u2019s a huge upgrade to HTTP 1.1.<\/p>\n There is just one \u2018catch\u2019 \u2013 all browsers require you support HTTPS in order to use it.<\/p>\n That\u2019s a good thing. Absolutely every site \u2013 new and existing \u2013 needs to be using HTTPS. Now, we know migrating an existing site can take time (we hope you have started working on that, or at least have a detailed plan). But news sites have no excuse. This is your chance to build everything from the ground up to be the best that it can be.<\/p>\n Here is why you want to use HTTPS:<\/p>\n We often hear people say that they don\u2019t need HTTPS because users don\u2019t need to login or the content of the site \u201cisn\u2019t sensitive.\u201d<\/p>\n The problem is that this ignores the multiple benefits that HTTPS provides. It isn\u2019t just about encryption (which is hugely important) \u2013 you also get integrity and authentication.<\/p>\n Integrity means that the data you send from your server is the same data your visitors will receive \u2013 with nothing added or removed along the way by networking tampering from an ISP, government, or other pesky person (more on this at the end).<\/p>\n Authentication ensures that you \u2013 and your users \u2013are actually connected to your server. Over HTTP, anyone could be responding to requests to access your server. That is pretty shocking when you think about it.<\/p>\n HTTPS prevents man-in-the-middle attacks and network re-routing \u2013 so no other server can pose as you. This is a risk no matter who you are. Network attackers don\u2019t have to target you \u2013 they can just start redirecting any and all sites. You want your users to know who they are really talking to.<\/p>\n Your site will be faster on HTTPS. Thanks to those improvements we mentioned in HTTP\/2 you actually get better performance<\/strong><\/a> by giving your users a secure connection<\/a>.<\/p>\n It isn\u2019t a small difference either. On real world sites using lots of images and multiple origins, HTTP\/2 can shave seconds off a load time.<\/p>\n So if you (or your bosses) think your site is fine without security, is it also fine being slow?<\/p>\n HTTPS has essentially been declared the future of the internet. That\u2019s because HTTP\/2, the first new version of the HTTP protocol since 1999, will only work with HTTPS<\/a>. All major browsers decided this was the best choice for the future of the web.<\/p>\n Without HTTP\/2 you are stuck on that old, tired HTTP 1.1. Do you really want your new website to rely on technology from the last millennium?<\/em><\/p>\n It isn\u2019t just HTTP\/2 that is being \u2018gated\u2019 by browsers. Mozilla<\/a> and Google<\/a> are restricting their browsers most powerful features to HTTPS. Browsers are becoming the home of modern applications \u2013 and they are making websites take some responsibility when using features that expose sensitive user data or access. That\u2019s why geolocation, device orientation, AppCache, and notifications are amongst features that require HTTPS.<\/p>\n Eventually, Mozilla wants to \u2018sunset\u2019 HTTP<\/a> \u201cafter which all new features will be available only to secure websites.\u201d<\/p>\n <\/p>\n \u2026And your browser is not afraid to say it. Google Chrome has been leading the charge here. At the beginning of this year Chrome added a \u201cNot Secure\u201d warning to some HTTP pages. Since then that warning has expanded \u2013 later this year it will appear on all HTTP pages<\/a> when browsing in Incognito Mode. Firefox has a similar warning for pages that accept logins over HTTP<\/a>.<\/p>\n This warning will continue to expand \u2013 just last month Chrome engineers wrote<\/a> \u201cwe plan to show the \u2018Not secure\u2019 warning for all HTTP pages.\u201d<\/p>\n Unfortunately the ISPs who we pay for our Internet access are more interested in squeezing extra profit<\/a> from our data than protecting it. Give these providers a way to tamper with your website and they will<\/a>.<\/p>\n Our government does not seem to care much either. Earlier this year the US Congress went out of its way to *undo* an FCC privacy policy<\/a> that would have limited ISPs abilities to sell your data. Some governments have gone so far as to use HTTP sites as a weapon<\/a>.<\/p>\n Its unfortunate, but clear: If you don\u2019t provide privacy to your users, nobody else will.<\/p>\n User don\u2019t want to worry if the history of every page they visit is being cataloged, stored, and sold; and you don\u2019t want to worry about what could be happening once data leaves your server.<\/p>\n Using HTTP means compromising your users privacy, opening your site up to network tampering (which can hurt performance and interfere with how your site is displayed), and dealing with the security risks of man-in-the-middle attacks. What a headache. Just use HTTPS!<\/p>\n <\/p>\n","protected":false},"excerpt":{"rendered":" Plain-text sites are stuck with a technology from 20 years ago. Before you go building a brand new HTTP website, think long and hard about 1999… In 1999: The global…<\/p>\n","protected":false},"author":2,"featured_media":4107,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[169,170,467],"class_list":["post-4102","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-http","tag-https","tag-ssltls","post-with-tags"],"views":8843,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/05\/iStock-636480120.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=4102"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4102\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/4107"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=4102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=4102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=4102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThat\u2019s right \u2013 HTTP 1.1 is from 1999 (actually, the first RFC is from 1997). So when you access a site over HTTP today you are using a technology that is 18 years old. Do you still work on a computer with a 400mhz processer and 128mb of RAM? No? So why serve your webpage from an equally outdated technology.<\/p>\nMore Than Just Encryption<\/h2>\n
Security AND Speed<\/h2>\n
![\"HTTP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/05\/http-vs-https.png\")
<\/p>\nHTTP\/2 & HTTPS Are the Future<\/h2>\n
HTTP is Not Secure<\/h2>\n
![\"HTTP](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/05\/http-website.png\")
<\/p>\nProtect Your Users & Your Site<\/h2>\n