I've set up a WordPress blog. Since I have to log into it from many different locations/machines, I've also got an SSL certificate, and set up Apache to redirect HTTP to HTTPS.

It all works, but I'm wondering whether that's an overkill. Since most people who go to my site don't have to log in, I'm starting to wonder whether HTTPS has some drawbacks.

If so, should I look for a way to make HTTPS optional?

2 Answers 2


Google's John Mueller says:

HTTPS-only sites are fine, there's absolutely no need to shy away from that if you implement it properly. There's certainly no penalty involved with running your site on HTTPS-only when done right. A few of the things that come to mind are (definitely incomplete, just from the top of my head):

  • don't forget the HTTP->HTTPS redirect & other canonicalization things
  • look into HSTS
  • list the HTTPS site separately in webmaster tools (it's a different site)
  • make sure the infrastructure can handle the higher load (SSL, caching, etc)
  • check out the differences wrt. caching


To be clear, just as there is no inherent disadvantage, there is also no ranking-advantage from using SSL in web-search, so I wouldn't use it in the vague hope that Google's algorithms will value the website more. There are good reasons to use it (and maybe soon it'll be something that's just default & expected from the start), but that isn't one of them. I'd love to see more sites using SSL, but as with whether or not the HTML is valid on a site (to pick one other similar thought), this doesn't seem like something which automatically makes a site more relevant to a user's query.

As of August 2014, Google has started to give a ranking boost to HTTPS sites. The ranking boost is so modest that most websites that have converted have not seen a detectable difference in their traffic levels. Other ranking signals such as keywords and back links are still much more important and dwarf any gains from HTTPS for most queries.


HTTPS only websites are getting the exact same SEO advantage, except that...

...if your SSL processing is slow then it will be slower than if you were just sending HTTP pages to Google and Google uses the time to target as a mean to judge your website quality.

This being said, on a really fast server you probably won't notice the difference.

If possible, I would force (redirect) requests to the log in page and any administration pages to make use of the HTTPS and all other pages remain HTTP. The HTTPS pages should have a rel=canonical link back to the HTTP page so Google only registers the HTTP URI and not the HTTPS (assuming you are not looking at also redirecting public pages from HTTPS to HTTP, but remember that doing so generates a warning to many people because the page "loses" security.)

  • Actually a correct answer, but keep in mind that sites switching between HTTP and HTTPS cannot be secured against SSL-strip. Commented Nov 7, 2013 at 9:27
  • Quite interesting security information. Actually, from what he's saying is that even if you start with HTTPS, it doesn't matter much (although it sounds that HTTPS only is fixed today.) Commented Nov 7, 2013 at 12:28
  • It is the first request that makes the difference. If the user cares, he can start with HTTPS (typing the url with https:// into the browser bar), this makes SSL-strip impossible on SSL-only sites. Whenever the user starts with HTTP as the first page, then SSL-strip can talk to the user with HTTP and to the site with HTTPS. A switching site will prevent the user from choosing HTTPS for the first request. Commented Nov 7, 2013 at 12:38
  • Would testing for a secure cookie with JavaScript help in that case? Because if the HTTPS is transformed to HTTP then the secure cookie cannot be forwarded (at least not as a secure cookie) Commented Nov 7, 2013 at 12:42
  • Not even this is bullet proof, but it could possibly thwart some automated attacks. 1) SSL-strip could simply remove the java-script that checks the cookie. 2) SSL-strip could easily offer SSL itself, then you would get a secure cookie as well as a valid certificate, though this certificate would be different of the domain you requested (but who checks that?). Commented Nov 7, 2013 at 12:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.