New answers tagged

1

You have two options to secure your main domain (mysite.com) and its sub-domains (play.mysite.com and test.mysite.com). SSL is not only for ecommerce, payment merchant sites where financial transactions or login credentials are shared over the website. It is as equally important for content-based website. Attackers always search for plain HTTP website or ...


0

GET requests could be seen as unique url. So any bot can access get data more quickly as unique url and judge contents. You can also cross verify all GET ajax calls againsts request url and desired format.


3

You can use the HTTP status code 410, which stands for Gone: The 410 (Gone) status code indicates that access to the target resource is no longer available at the origin server and that this condition is likely to be permanent. […] The 410 response is primarily intended to assist the task of web maintenance by notifying the recipient that the ...


3

Googlebot only performs POST requests under very limited circumstances where it is believed by the Googlebot that it is safe and appropriate. Google takes precautions to avoid performing tasks on a site that could result in executing an unintended user action and Google making POST requests is for crawling purposes only to index what the end user would see. ...


0

And, just to add one more thing to all answers, I'll just talk about latency. Because, it seems that no one wrote here about this. Having a low client-to-server HTTP latency is critical for making fast-loading, responsive websites. TCP/IP alone has 3-way handshake (initial connection setup for plain HTTP over TCP requires 3 packets). When SSL/TLS is used, ...


1

In addition to the other answers, browsers should (as in RFC 2119) send the User-Agent header. It provides enough information about what platform a user is using if he sends the actual User-Agent. If Eve can eavesdrop on a request made by Alice, and Alice sends the actual User-Agent, Eve will know what platform Alice uses without Alice making a connection to ...


1

The simple answer is that there's no good reason not to. In the past there were arguments about only using SSL where absolutely necessary (e.g. on ecommerce sites collecting payment details). These were largely to do with the installation procedure for SSL certificates, cost, additional load on the webserver, and network limitations - at a time when people ...


9

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds. Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.


10

(Parts taken from my answer to a similar question.) HTTPS can achieve two things: Authentication. Making sure that the visitor is communicating with the real domain owner. Encryption. Making sure that only this domain owner and the visitor can read their communication. Probably everyone agrees that HTTPS should be mandatory when transmitting secrets (...


1

Besides the benefits mentioned by others there is one reason that will make you switch to SSL unless you don't care about your visitors that use Chrome - the new versions of Chrome (starting from the end of the year as far as I remember) are going to show a warning (which will drive away users from your site) by default for all sites that aren't using HTTPS. ...


3

Marketing firms like Hitwise pay ISPs to gather data about your site when you don't use SSL. Data about your site gets collected which you might rather not have your competitors know: user demographics visitor statistics popular pages search engine keywords (although with "not provided" this is less of an issue these days)


70

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include: injecting ads for your competitors injecting ads ...


6

It prevents man in the middle attacks that make you think you are visiting your site but present a page that is actually from another and may attempt to get info from you. Since the data is encrypted, it also makes it more difficult for an attacker to manipulate the page as you see it. Because you need a SSL certificate, that verifies you are the owner of ...


20

"nothing secret on the site" ...According to you. There migh be a perfectly fine reason someone wants a secure connection. It (partly) creates privacy: My admin can see that I'm browsing some picture site on my phone via url, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "...


0

An issue such as this occurs either when the network has bee blocked by the mobile internet company or when their proxy server is having problems connecting to the network. Now you mention in comments that it was an issue in the end with T-Mobile blocking the host-ed.com subnet as their systems have not been updated properly to handle ipv4 traffic from 5.0.0....


1

I would NOT do ssl unless it is a SHA2 official CERT and unless you have control of httaccess folder redirections. Run a Google search for: "FORCING ssl via htaccess" (Note that Google Chrome may show you an error on a CERT if it is a SHA1).


1

The problem with automatic redirection based on the user's language is that it could prevent users and search engines from viewing all the versions of your site. The best approach is to cross link each language version of a page, so the user can reach the desired language with a language selector easily, and search engines won't get confused (besides many ...



Top 50 recent answers are included