3

I finally decided to jump on the HTTPS bandwagon after discovering that C-Panel has an auto-HTTPS setting. But I think I've opened a can of worms; I've found myself dealing with a variety of problems.

My webstats currently display in two separate series, for http and https. I've found the trick for making my sites default to https: add this to the htaccess file...

RewriteEngine On 
RewriteCond %{SERVER_PORT} 80 
RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]

But here's my question:

Should I make my pages default to https, or is https an option I should leave up to my visitors?

Alternatively, is there a sort of "semi-default" solution, where visitors are automatically taken to URL's beginning with https, but, if they opt to change to http, it will work just as well?

  • You do not want HTTP and HTTPS. You want one or the other. Since you have gone through the trouble, HTTPS is preferred. You will want to redirect your HTTP site to HTTPS. You will also want to make sure all your internal links and resources are referenced using HTTPS. Please know that changing to HTTPS is a disruption, however, in the end, you will enjoy at least the same results as with HTTP. This disruption will take as long or nearly as long as a new site takes to index so do not freak out. Everything will be okay. Honest! – closetnoc Jun 4 '17 at 1:49
  • Sounds great. I'll go ahead and add the code to my .htaccess files. – David Blomstrom Jun 4 '17 at 2:04
  • Make sure when you add that to .htaccess you make it 3 lines like in my edit – Steve Jun 4 '17 at 5:28
3

Firstly it is a bad practice to have pages accessible through either HTTP or HTTPS. The push these days within the web industry is for all web pages to adopt HTTPS, even ones where there is no information necessarily needing HTTPS protection. Given the emergence of affordable (and even free) HTTPS services designed specifically to secure websites for free or cheap practically speaking there is no reason not to have your entire site protected by HTTPS.

As a side note while it is considered a relatively low ranking signal having HTTPS is still a signal that Google uses in the indexing process and so could be argued as beneficial for any website given the relative ease and affordability of implementing HTTPS. The only down side that I am aware of with HTTPS is a marginal decrease in site speed and by marginal I mean in most instances it is imperceptible and only detectable through logs indicating site speed.

3

Is https an option I should leave up to my visitors?

Users usually types just www.example.com to the address bar, leaving http:// or https:// out. As usually browsers defaults to HTTP, not enforcing TLS is almost as not having it at all. Therefore, you should always redirect HTTP to HTTPS.

Nowadays you can make this further by implementing HTTP Strict Transport Security (HSTS, RFC 6797), a header that makes browser remember that this site should always be loaded using TLS. I have listed some reasons for using and enforcing HTTPS on an answer on Serverfault.

0

You should allways make them use https if you have a certificate, helps them better trust a website. Me personally if I go to a site and it sends me to https I trust it a lot more than one without https

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.