Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
I have a ecommerce website that sells software and all transactions are secured using PayPal as the payment gateway. Since all transactions are secure using PayPals SSL it doesn't seem worth the time or money to enable it on my site.
Question(s):
Google has described the HTTPS ranking boost as minimal. The biggest effect of the boost is that Google will generally prefer the HTTPS site to resolve duplicates.
After Google announced the HTTPS boost, many web site owners migrated their sites but reported seeing no discernible changes in rankings. In fact, it is common to see a temporary drop in rankings when migrating from HTTP to HTTPS.
Yes, it's worth extra cost.
HTTP is not secure and does nothing to ensure user privacy while surfing the web. Google has taken the next step towards implementing HTTPS encryption everywhere by integrating the Security Panel in DevTools, which will help developers know how to obtain a green padlock and effectively make all web connections private and secure.
The advantage to sites like yours is that you will protect your visitors from potential "man in the middle" attacks where an agent can intercept traffic and pretend to be you, eventually leading to stolen credit card numbers and death.
I may be exaggerating.
It gives visitors some feeling of security, however insignificant it may be, so it's also a marketing angle.
I'm not downplaying the significance of actual security, however. While it's far from likely you will be affected, the truth is it does happen even to smaller companies and web sites. The cost to switch to SSL/HTTPS can be virtually nothing but I don't know your setup or situation.
I would not switch only as a SEO advantage. The boost you get is very minor.
Google released in 2014 that there was a very slight ranking increase for some sites (less than 1%), however given that Google has expressed a desire to see all sites serving pages securely it may become a ranking factor in the future. But it is worthwhile, mainly to protect personal customer data, increase customer trust and satisfaction (especially since browsers are starting to highlight insecure connections), and resolve duplicates among other reasons covered in other similar articles.
As of 2015, Googlebot automatically began checking as to whether each link could be viewed over https, and if so would index the https version site links. Any site link with https gets a very slight boost increase.
Just keep in mind that there will be some work to migrate your site to SSL, depending on how it and the server is setup (absolute links, plugins that may not be coded correctly to handle SSL gracefully, etc.). But resolving these things will generally result in a better site all round.
A no cost way of activating SSL is by using Cloudflare. Their free service provides SSL automatically using their own trusted certificates. I don't work for them but have successfully used their service for years. Our sites are better protected, served faster, and more secure because of it. So as to avoid being seen as promoting them, you should check them out for yourself. They provide many other benefits (proxying, CDN, offline serving, enhanced security) as well.
Update
Google has more recently revealed that https is going to be a more important factor in 2017, particularly for site credibility. Whether your site is considered "trustworthy" is of significant importance to your site visitors - for that reason alone SSL is now becoming a "must do", particularly with more recent browser versions have moved to more explicitly highlight sites which are not being served securely, with users warned that they are accessing insecure form pages.
For the benefit of subsequent readers, Let's Encrypt is a free certificate authority who launched in 2016, launched by the EFF.
