Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS.

It all works, but I'm wondering whether that's an overkill. Since most people who go to my site don't have to log in, I'm starting to wonder whether HTTPS has some drawbacks.

If so, should I look for a way to make HTTPS optional?

share|improve this question
add comment

2 Answers

Google's John Mueller says:

HTTPS-only sites are fine, there's absolutely no need to shy away from that if you implement it properly. There's certainly no penalty involved with running your site on HTTPS-only when done right. A few of the things that come to mind are (definitely incomplete, just from the top of my head):

  • don't forget the HTTP->HTTPS redirect & other canonicalization things
  • look into HSTS
  • list the HTTPS site separately in webmaster tools (it's a different site)
  • make sure the infrastructure can handle the higher load (SSL, caching, etc)
  • check out the differences wrt. caching

...

To be clear, just as there is no inherent disadvantage, there is also no ranking-advantage from using SSL in web-search, so I wouldn't use it in the vague hope that Google's algorithms will value the website more. There are good reasons to use it (and maybe soon it'll be something that's just default & expected from the start), but that isn't one of them. I'd love to see more sites using SSL, but as with whether or not the HTML is valid on a site (to pick one other similar thought), this doesn't seem like something which automatically makes a site more relevant to a user's query.

share|improve this answer
add comment

HTTPS only websites are getting the exact same SEO advantage, except that...

...if your SSL processing is slow then it will be slower than if you were just sending HTTP pages to Google and Google uses the time to target as a mean to judge your website quality.

This being said, on a really fast server you probably won't notice the difference.

If possible, I would force (redirect) requests to the log in page and any administration pages to make use of the HTTPS and all other pages remain HTTP. The HTTPS pages should have a rel=canonical link back to the HTTP page so Google only registers the HTTP URI and not the HTTPS (assuming you are not looking at also redirecting public pages from HTTPS to HTTP, but remember that doing so generates a warning to many people because the page "loses" security.)

share|improve this answer
    
Actually a correct answer, but keep in mind that sites switching between HTTP and HTTPS cannot be secured against SSL-strip. –  martinstoeckli Nov 7 '13 at 9:27
    
Quite interesting security information. Actually, from what he's saying is that even if you start with HTTPS, it doesn't matter much (although it sounds that HTTPS only is fixed today.) –  Alexis Wilke Nov 7 '13 at 12:28
    
It is the first request that makes the difference. If the user cares, he can start with HTTPS (typing the url with https:// into the browser bar), this makes SSL-strip impossible on SSL-only sites. Whenever the user starts with HTTP as the first page, then SSL-strip can talk to the user with HTTP and to the site with HTTPS. A switching site will prevent the user from choosing HTTPS for the first request. –  martinstoeckli Nov 7 '13 at 12:38
    
Would testing for a secure cookie with JavaScript help in that case? Because if the HTTPS is transformed to HTTP then the secure cookie cannot be forwarded (at least not as a secure cookie) –  Alexis Wilke Nov 7 '13 at 12:42
    
Not even this is bullet proof, but it could possibly thwart some automated attacks. 1) SSL-strip could simply remove the java-script that checks the cookie. 2) SSL-strip could easily offer SSL itself, then you would get a secure cookie as well as a valid certificate, though this certificate would be different of the domain you requested (but who checks that?). –  martinstoeckli Nov 7 '13 at 12:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.