Episode #125 of the Stack Overflow podcast is here. We talk Tilde Club and mechanical keyboards. Listen now

Questions tagged [https]

HTTPS is the secure version of the hypertext transfer protocol (HTTP). It usually uses port 443 and is powered by the TLS (formerly SSL) cryptographic protocol.

Filter by
Sorted by
Tagged with
8
votes
3answers
5k views

HTTPS best practices for SEO and usability

Consider a page, http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they ...
8
votes
3answers
2k views

When redirecting from http to https in a shop site, which status code should I use?

On a shop website, when "Pay now" is clicked we perform a header redirection to the same URL, just an SSL secured https version. In such a common scenario, should we use a permanent (301), a ...
8
votes
5answers
233 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
8
votes
1answer
4k views

What happens to a user's browser if an SSL certificate is replaced in mid-session?

In light of modern browsers phasing out security certificates signed using the SHA1 hash algorithm, we're busy replacing all our SHA1 certificates with SHA2. Generally we could simply replace certs ...
8
votes
3answers
9k views

Will a simple domain validated SSL certificate show a 'green lock'?

I'm looking into buying an SSL certificate for my domain. I'm considering buying: https://www.ssl.nu/en/products/regular+ssl/ssl+basic/ which is just a domain validation certificate I think. Will ...
8
votes
2answers
356 views

Is it still recommended to inline above the fold CSS with the adoption of http/2?

For awhile now I've been following Google's recommendation here (https://developers.google.com/speed/docs/insights/OptimizeCSSDelivery) to inline critical above the fold CSS for faster load times. I ...
8
votes
1answer
2k views

In which webmaster property should I submit the HTTPS sitemap after moving site from HTTP to HTTPS?

We have the following properties in Google Webmaster Tools: www.example.com (was preferred) example.com https://www.example.com https://example.com The old sitemap, ie. the HTTP sitemap.xml which ...
8
votes
1answer
365 views

Will implementing HSTS prevent Googlebot from seeing 301 permanent redirects from HTTP to HTTPS?

I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google. As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-...
8
votes
2answers
819 views

Ad service that supports ssl (secure publishing)

Is there an add service like adsense that supports SSL ads? I wish to put ads on a secured (https) pages but Google Adsense doesn't support it. I know Adbrite works for text based SSL ads but I ...
7
votes
4answers
9k views

Is there a way to disallow crawling of only HTTPS in robots.txt?

I just realized that Bingbot is crawling my company's website's pages over https. Bing already crawls the site over http, so this seems frivolous. Is there a way to specify Disallow: / for https ...
7
votes
3answers
212 views

What can I do to pay less for SSL?

I currently have a web hosting account and 27 domains that cost 1310 PLN (about $358.37) per year. Because the next version of Chrome will start displaying "not secure" warnings when a user enters ...
7
votes
3answers
11k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
7
votes
2answers
571 views

Using HTTPS on the entire sites 2011 and beyond

I know this has been asked before, but I am curious what all of you guys think, with the advent of programs like firesheep, released only 6 months ago. Is it a good idea to use https on an entire site?...
7
votes
3answers
1k views

Should I disallow crawling of HTTP after moving to HTTPS?

I am migrating my well indexed website from HTTP to HTTPS only. Steps planned: All HTML pages canonical to be HTTPS now All HTTP pages will 301 redirect to HTTPS with the same URL All sitemaps will ...
7
votes
1answer
274 views

If a website is accessed on HTTPS instead of HTTP, should the URLs on the sitemap be HTTPS or HTTP?

I have changed my website from HTTP to HTTPS. At this moment, I have the next rewrite rule working to redirect calls for HTTP to HTTPS: RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(...
7
votes
3answers
606 views

How do I remove HTTPS results from Google after the domain has been redirected and the SSL certificate taken down?

I need to remove HTTPS results from Google search rankings for the domain A that has been redirected to another domain B. So domain A does not have any pages on it at the moment and it will not have ...
7
votes
2answers
389 views

Looking for SSL certificates (first time)

I need to buy SSL certificates and it is the first time. 1) My option would be the "cheapest ones". What am I going to risk, what kind of service quality I'm going to lose if I buy the cheapest ? Are ...
7
votes
1answer
12k views

Locate sitemap at HTTP or HTTPS?

Our homepage has a 301 redirect from HTTP to HTTPS but all other pages on the site are on HTTP. (1) Should the sitemap be located at HTTPS and is there any problem if we: (2) include the HTTPS ...
7
votes
3answers
578 views

Using wildcard certificates

Can I buy a wildcard certificate to use the same SSL certificate on multiple domains? For example, www.example.com, www.example.org and www.example.net (on different hosting services)? If I can, Is ...
7
votes
2answers
12k views

Comodo SSL Certificate showing as invalid on Android Devices

I run a website where I have full cpanel and limited whm access. I recently upgraded one of my domains to include SSL (A first-time experience for me). The certificates are installed in cpanel, and ...
7
votes
2answers
862 views

2 SSL certificates?

I just spend ages moving all static content to a cookiless domain to help performance, it seems to work great! It got me thinking though, when I install SSL on my main site, am I also going to have ...
7
votes
2answers
462 views

SSL Warranty - Meaningless?

Lots of SSL seem to come with a warranty: Extended Validation, Green Address Bar 40-bit minimum to 256-bit encryption USD $100,000 warranty VeriSign Trust™ Seal and services Has anyone in history ...
7
votes
1answer
627 views

Will Bing bot index pages with invalid SSL certificates?

Bingbot and Yahoo Slurp do not support SNI (Server Name Indication) when using SSL. Ignoring other workarounds (multi domain certificates, non-SSL content etc.). Will Bingbot index pages that have an ...
6
votes
4answers
6k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
6
votes
3answers
1k views

SSL/https breaking when using www

Please don't close for being a duplicate, I have already tried the other answered questions and am still having issues. First, I know why the certification for the site breaks when using www. The ...
6
votes
3answers
8k views

Adding links: can I use //domain (double slash) for both https:// and http://

We are moving to https soon. I understand that it is smart to use //domain.com links and images src references. Does the browser then first try https? and if not found http? Is this supported by ...
6
votes
3answers
152 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
6
votes
4answers
2k views

“Not Provided” keywords from Google search: If your site uses https, does Google always send the keywords in the referrer?

Over the last two years the number of "keyword not provided" referrals from Google Search has grown to close to 30% for my websites. Google does not send the keyword in the referer URL when the user ...
6
votes
1answer
550 views

Google Webmaster Tools no longer reports search queries now site has gone full HTTPS

After the recent announcement by Google that was speculated for a while in the SEO community, that sites that load over https (ssl) will be weighted slightly higher in the search algorithms, I quickly ...
6
votes
3answers
14k views

Properly force SSL with .htaccess, no double authentication

I am trying to force SSL with .htaccess on a shared host. This means there I only have access to .htaccess and not the main VirtualHost configuration. I know you can put a rule in the VirtualHost ...
6
votes
3answers
1k views

Is an .htaccess edit necessary when enabling Cloudflare SSL?

I have recently changed 3-4 of my sites to Cloudflare SSL. After that, I went to General Settings on WordPress and changed URLs from HTTP to HTTPS. And it redirects from HTTP to HTTPS without any ...
6
votes
3answers
15k views

Google Analytics: How can I track between http:// and https:// profiles for a domain?

I'm trying to set up tracking on a project that I'm working on. The main site is at http://www.example.com/ The order page is at https://www.example.com/index.php Currently they have two different ...
6
votes
2answers
511 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
6
votes
6answers
6k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
1answer
310 views

Will it have a negative influence on search engine ranking if my main site is working over HTTPS but my blog isn't?

Suppose I have domain working https like https://www.example.com/ and my blog is working without https like http://blog.example.com/. Is that wrong from SEO or Google point of view?
6
votes
2answers
1k views

Ad networks that will serve via HTTPS?

I've built a website with 160K page views per month that serves every page over HTTPS. The recent FireSheep news will probably increase the adoption of "HTTPS everywhere" but it's been very hard to ...
6
votes
2answers
1k views

Check browser compatibility of SSL

I wanted to add SSL to my domain and as EV SSL is very expensive I'm going to go with DV SSL. because I just what to enable encrypted logins. Different companies offer different prices even free and ...
6
votes
3answers
706 views

https (SSL) instead of http for mobile users

I am building myself a new website, out of privacy and security concerns I am contemplating trying to make it https only. It will be mobile-friendly using media queries but I am concerned--especially ...
6
votes
2answers
292 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
1answer
10k views

How to install mod_ssl for Apache

I have installed Apache httpd a while ago and have recently come back to it to try setup SSL and get it serving several different tomcat servers. At the moment I have two completely separate tomcat ...
6
votes
2answers
3k views

AMP Pages on HTTP or HTTPS?

Next month Google Search will integrate AMP pages. These are pages that are designed to work rapidly on mobile devices even when using a poor network connection. Should I host these AMP pages on a ...
6
votes
1answer
3k views

Redirect from SSL HTTPS to HTTP (NO SSL)

Many of my visitors have bookmarked my site already with https://mydomain.com. Under the bad advice of a programmer I have put my whole site (Joomla) using SSL. I do not sell anything or provide any ...
6
votes
2answers
2k views

What is the easiest reliable way to host a HTTPS enabled static page on a domain I own

I'm looking for a simple & reliable way to host a HTTPS enabled static page on a domain I own. The fist thing that came to mind was S3 static website hosting but there seems to be no way to enable ...
6
votes
1answer
4k views

Can I expect browsers to cache static content served over SSL encryption?

With all the talk about FireSheep I am thinking of switching my web applications to use full https accross the entire site. However, I am concerned about caching. I use a lot of JavaScript, CSS files, ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
6
votes
2answers
208 views

Switching to HTTPS - redirect question

Following the recent Google announcements about improved ranking for sites running on https we have a number of clients asking about this. Is it safe to just 301 redirect all pages to their SSL ...
5
votes
3answers
2k views

EV SSL Certificates - does anyone care? [closed]

Is any one aware of any data or studies from an impartial source that show the impact of EV SSL certificates on customer behavior? I've been unable to find any such studies. If an EV SSL certificate ...
5
votes
2answers
2k views

How can I serve all resources under HTTPS instead of HTTP without changing their URLs in the HTML code

I know that by using an .htaccess file I can redirect everyone to https://. However, my SSL certificate complains if all the content isn't served under HTTPS. Is there a way to convert all the ...
5
votes
2answers
6k views

Untrusted Cloudflare SSL Certificate

I'm just dipping my toes into the water with SSL certificates and figured I'd try Cloudflare's free offering... I'm trying to secure a sub-domain that hosts map tiles locally within the country for ...
5
votes
1answer
4k views

Does an SSL Certificate actually require a dedicated IP?

My web host which I have been with for at least going on 8 years now is requiring a dedicated IP address, which is $3.33/Month now for assigning a SSL Certificate with my web hosting package and ...