1

For the past couple weeks now we have seen a non-secure warning displayed on our site where the SSL/Security info for a website would normally be displayed (in Chrome). Along with this I have noticed a slight drop in rankings ever since, dropping off slowly in comparison to competitor sites who use an SSL certificate.

My question is what are the true repercussions from this? Would it be just a drop off in rankings or would it be more significant? I accept that it may put some people off purchasing but unfortunately there isn't much we can do in the short term.

Note: We have also had an issue come up inside Google Search Console which notes that we have non secure password fields on our site, should this be something that needs urgent correction? Or is it more something to think about for the future?

2

Yes, this is a significant issue, and it should be resolved urgently.

  • SEO: Google announced in 2014 that not having SSL/TLS will have a negative effect on ranking. See here for some SEO analysis. Basically, it has an effect, but it's not that large. Yet. I would assume that the effect will increase in the future. Google is a big supporter of SSL/TLS, and recent developments - updating the Chrome interface, publicly chastising the largest certificate issuer for poor practices - indicate that they do plan to get active.
  • Security: Any site that handles user data in any form should support SSL/TLS for security and privacy reasons. For an ecommerce site, not having SSL/TLS is completely unacceptable (even if you use an external payment processor, you likely collect some data such as usernames, passwords, and possibly what users buy, where they live, etc). If an ecommerce site doesn't even support SSL/TLS, I would also be surprised if it didn't contain other, even more serious security issues. Others will likely make the same assumption, making you a more likely target.
  • User Satisfaction: As you mentioned, at least some users will be put off. I would suspect that the amount is non-negligible, and I would also suspect that the amount should have increased considerably after Firefox started displaying a prominent warning on password fields, and that it will only get worse, as Chrome will make its warning more prominent.
  • Image Problems: See above; Not having the basic security measures in place that are expected can lead to image problems.
  • Potential financial loss: Depending on how exactly your website works - especially how the addition and editing of products and the payment process are handled - this may lead to financial losses (in addition to the losses because users do not want to use unsafe platforms).
  • Legal Problems: I'm assuming that you are using an external payment processor, but if you yourself handle credit card info, you would need to follow the PCI DSS which mandates SSL/TLS. Depending on your location, you may be required to provide SSL/TLS even if not handling credit card data, but other user data (username, password, name, address, telephone number, email address, etc).
0

It is a serious issue for all the aspects that @tim has written in his answer. I don't want to go further because he covered with simple words all the topics.

I want just to suggest, If the SSL/TLS implementation is not possible on all your webpages, you can just implement SSL/TLS only on the core webpages of your website which needs the encryption of the sensitive data. This solution is acceptable by Google rules about the SSL/TLS. You can see also a brief suggestion about that on your google console.

e.g.
SSL/TLS (https) on the login pages, and pay the order page where the payment card details should be inputted in the proper fields.

  • Just securing login and payment is definitely better than nothing, but I wouldn't recommend it. do you have a link for Googles recommendation you mentioned? Because I see few use-cases where this is actually easier to implement than full SSL, and there are multiple downsides. This would eg still not protect privacy, which may cause real troubles depending on what is sold (you may not want others in your vicinity knowing what products you are looking at), and is just bad in general (ISPs may for example soon be able to sell your browsing habits). – tim Mar 29 '17 at 20:59
  • There are also unnecessary pitfalls when implementing this. You would eg need to not send the session cookie over HTTP (ensuring this is easy via secure flag, but you may want that cookie eg for shopping carts). Finally, and most importantly, just protecting login pages can cause problems in the case of an active mitm, who may eg strip SSL from the login (thus enabling them to read plaintext passwords, etc), or inject their own content (ads, phishing attempts, etc). – tim Mar 29 '17 at 20:59
  • @tim Sure, I totally agree with you that everything has to be over SSL/TSL. But because, the full SSL/TLS implementation can cause problems on site and Google knows that because if you call assets over HTTP protocol, even if you apply SSL/TSL, your website can be flagged as "untrusted" on some webpages because the HTTP calls on images, a fast reaction is to secure the "sensitive" pages. Btw, developers.google.com/web/updates/2016/10/avoid-not-secure-warn And I am sure that I saw that on my webmaster tools when I had a notification about the SSL/TSL. – Greg Mar 30 '17 at 0:12
  • @tim by the way, Jvital has to have in his google console the "problematic" webpages flagged by google itself. – Greg Mar 30 '17 at 0:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.