Now that Let's Encrypt is in public beta, I'm adding secure browsing to many of my web sites. But should I force secure access, or allow visitors to choose how they access those sites?
In researching this, I've found statements like the following:
Secure browsing does add some overhead, but not enough to worry about.
Google prefers secure sites, and ranks them more highly.
Google sees a page that is available via both HTTP and HTTPS as duplicate content, which may hurt search ranking.
Google's documentation seems to confirm #2, but not #3: