Questions tagged [https]

HTTPS is the secure version of the hypertext transfer protocol (HTTP). It usually uses port 443 and is powered by the TLS (formerly SSL) cryptographic protocol.

Filter by
Sorted by
Tagged with
8
votes
1answer
5k views

Secure and non-secure Schema.org Markup?

Is it possible to have schema.org itemtypes for both secure and insecure ports? I run a static-ish site made in Jekyll, and am implementing Schema.org on the individual pages. As a result, I'm ...
8
votes
3answers
5k views

HTTPS best practices for SEO and usability

Consider a page, http://example.com, which can be viewed both publicly and when a user authenticates. Now suppose you enable HTTPS for every page when a user logs into your website, but only when they ...
8
votes
3answers
2k views

When redirecting from http to https in a shop site, which status code should I use?

On a shop website, when "Pay now" is clicked we perform a header redirection to the same URL, just an SSL secured https version. In such a common scenario, should we use a permanent (301), a ...
8
votes
5answers
243 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
8
votes
1answer
5k views

What happens to a user's browser if an SSL certificate is replaced in mid-session?

In light of modern browsers phasing out security certificates signed using the SHA1 hash algorithm, we're busy replacing all our SHA1 certificates with SHA2. Generally we could simply replace certs ...
8
votes
1answer
12k views

Locate sitemap at HTTP or HTTPS?

Our homepage has a 301 redirect from HTTP to HTTPS but all other pages on the site are on HTTP. (1) Should the sitemap be located at HTTPS and is there any problem if we: (2) include the HTTPS ...
8
votes
3answers
9k views

Will a simple domain validated SSL certificate show a 'green lock'?

I'm looking into buying an SSL certificate for my domain. I'm considering buying: https://www.ssl.nu/en/products/regular+ssl/ssl+basic/ which is just a domain validation certificate I think. Will ...
8
votes
2answers
407 views

Is it still recommended to inline above the fold CSS with the adoption of http/2?

For awhile now I've been following Google's recommendation here (https://developers.google.com/speed/docs/insights/OptimizeCSSDelivery) to inline critical above the fold CSS for faster load times. I ...
8
votes
1answer
2k views

In which webmaster property should I submit the HTTPS sitemap after moving site from HTTP to HTTPS?

We have the following properties in Google Webmaster Tools: www.example.com (was preferred) example.com https://www.example.com https://example.com The old sitemap, ie. the HTTP sitemap.xml which ...
8
votes
1answer
394 views

Will implementing HSTS prevent Googlebot from seeing 301 permanent redirects from HTTP to HTTPS?

I did a migration from http:// to https:// for a big site with more than 2 million of URLs indexed on Google. As others have mentioned I'm also experiencing a bit of fluctuation on organic traffic (-...
8
votes
2answers
829 views

Ad service that supports ssl (secure publishing)

Is there an add service like adsense that supports SSL ads? I wish to put ads on a secured (https) pages but Google Adsense doesn't support it. I know Adbrite works for text based SSL ads but I ...
7
votes
4answers
7k views

Does SSL require a client side certificate of any kind at all?

A friend insists it does, that both browser and server both need certificates. I say no, only the server requires one, with two keys. The question is whether the browser uses some sort of certificate (...
7
votes
4answers
9k views

Is there a way to disallow crawling of only HTTPS in robots.txt?

I just realized that Bingbot is crawling my company's website's pages over https. Bing already crawls the site over http, so this seems frivolous. Is there a way to specify Disallow: / for https ...
7
votes
3answers
216 views

What can I do to pay less for SSL?

I currently have a web hosting account and 27 domains that cost 1310 PLN (about $358.37) per year. Because the next version of Chrome will start displaying "not secure" warnings when a user enters ...
7
votes
2answers
7k views

Performance: 4096 Bit RSA-Key compared to 2048 bit RSA-Key

Is there a comparison between 4096 Bit RSA-Key and a 2048 Bit RSA-Key? I'd like to know what impact on performance it has, if I'm choosing a 4096-Bit key for ssl-encryption. Is there any info which ...
7
votes
3answers
13k views

Do internal intranet websites need to be secure?

The question is in the title. Does an internal site need to have https security? For example we have an internal site that handles our client's license keys -- do we need for that to be secure since ...
7
votes
2answers
573 views

Using HTTPS on the entire sites 2011 and beyond

I know this has been asked before, but I am curious what all of you guys think, with the advent of programs like firesheep, released only 6 months ago. Is it a good idea to use https on an entire site?...
7
votes
3answers
2k views

Should I disallow crawling of HTTP after moving to HTTPS?

I am migrating my well indexed website from HTTP to HTTPS only. Steps planned: All HTML pages canonical to be HTTPS now All HTTP pages will 301 redirect to HTTPS with the same URL All sitemaps will ...
7
votes
1answer
281 views

If a website is accessed on HTTPS instead of HTTP, should the URLs on the sitemap be HTTPS or HTTP?

I have changed my website from HTTP to HTTPS. At this moment, I have the next rewrite rule working to redirect calls for HTTP to HTTPS: RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(...
7
votes
3answers
756 views

How do I remove HTTPS results from Google after the domain has been redirected and the SSL certificate taken down?

I need to remove HTTPS results from Google search rankings for the domain A that has been redirected to another domain B. So domain A does not have any pages on it at the moment and it will not have ...
7
votes
2answers
393 views

Looking for SSL certificates (first time)

I need to buy SSL certificates and it is the first time. 1) My option would be the "cheapest ones". What am I going to risk, what kind of service quality I'm going to lose if I buy the cheapest ? Are ...
7
votes
3answers
620 views

Using wildcard certificates

Can I buy a wildcard certificate to use the same SSL certificate on multiple domains? For example, www.example.com, www.example.org and www.example.net (on different hosting services)? If I can, Is ...
7
votes
2answers
13k views

Comodo SSL Certificate showing as invalid on Android Devices

I run a website where I have full cpanel and limited whm access. I recently upgraded one of my domains to include SSL (A first-time experience for me). The certificates are installed in cpanel, and ...
7
votes
2answers
865 views

2 SSL certificates?

I just spend ages moving all static content to a cookiless domain to help performance, it seems to work great! It got me thinking though, when I install SSL on my main site, am I also going to have ...
7
votes
2answers
468 views

SSL Warranty - Meaningless?

Lots of SSL seem to come with a warranty: Extended Validation, Green Address Bar 40-bit minimum to 256-bit encryption USD $100,000 warranty VeriSign Trust™ Seal and services Has anyone in history ...
7
votes
1answer
633 views

Will Bing bot index pages with invalid SSL certificates?

Bingbot and Yahoo Slurp do not support SNI (Server Name Indication) when using SSL. Ignoring other workarounds (multi domain certificates, non-SSL content etc.). Will Bingbot index pages that have an ...
6
votes
3answers
1k views

SSL/https breaking when using www

Please don't close for being a duplicate, I have already tried the other answered questions and am still having issues. First, I know why the certification for the site breaks when using www. The ...
6
votes
3answers
152 views

Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?

My host gave me a subdomain of their domain that has HTTPS: https://mysite.example.com My own domain name has no SSL installed, so the only way I can take advantage of encryption is by using the ...
6
votes
4answers
2k views

“Not Provided” keywords from Google search: If your site uses https, does Google always send the keywords in the referrer?

Over the last two years the number of "keyword not provided" referrals from Google Search has grown to close to 30% for my websites. Google does not send the keyword in the referer URL when the user ...
6
votes
2answers
7k views

Untrusted Cloudflare SSL Certificate

I'm just dipping my toes into the water with SSL certificates and figured I'd try Cloudflare's free offering... I'm trying to secure a sub-domain that hosts map tiles locally within the country for ...
6
votes
1answer
551 views

Google Webmaster Tools no longer reports search queries now site has gone full HTTPS

After the recent announcement by Google that was speculated for a while in the SEO community, that sites that load over https (ssl) will be weighted slightly higher in the search algorithms, I quickly ...
6
votes
3answers
15k views

Properly force SSL with .htaccess, no double authentication

I am trying to force SSL with .htaccess on a shared host. This means there I only have access to .htaccess and not the main VirtualHost configuration. I know you can put a rule in the VirtualHost ...
6
votes
3answers
1k views

Is an .htaccess edit necessary when enabling Cloudflare SSL?

I have recently changed 3-4 of my sites to Cloudflare SSL. After that, I went to General Settings on WordPress and changed URLs from HTTP to HTTPS. And it redirects from HTTP to HTTPS without any ...
6
votes
3answers
15k views

Google Analytics: How can I track between http:// and https:// profiles for a domain?

I'm trying to set up tracking on a project that I'm working on. The main site is at http://www.example.com/ The order page is at https://www.example.com/index.php Currently they have two different ...
6
votes
2answers
529 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
6
votes
6answers
6k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
1answer
310 views

Will it have a negative influence on search engine ranking if my main site is working over HTTPS but my blog isn't?

Suppose I have domain working https like https://www.example.com/ and my blog is working without https like http://blog.example.com/. Is that wrong from SEO or Google point of view?
6
votes
2answers
1k views

Ad networks that will serve via HTTPS?

I've built a website with 160K page views per month that serves every page over HTTPS. The recent FireSheep news will probably increase the adoption of "HTTPS everywhere" but it's been very hard to ...
6
votes
2answers
1k views

Check browser compatibility of SSL

I wanted to add SSL to my domain and as EV SSL is very expensive I'm going to go with DV SSL. because I just what to enable encrypted logins. Different companies offer different prices even free and ...
6
votes
3answers
732 views

https (SSL) instead of http for mobile users

I am building myself a new website, out of privacy and security concerns I am contemplating trying to make it https only. It will be mobile-friendly using media queries but I am concerned--especially ...
6
votes
2answers
295 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
1answer
10k views

How to install mod_ssl for Apache

I have installed Apache httpd a while ago and have recently come back to it to try setup SSL and get it serving several different tomcat servers. At the moment I have two completely separate tomcat ...
6
votes
2answers
744 views

What are the benefits of requiring HTTPS between AWS CloudFront and the origin server?

I am hosting a website on Amazon CloudFront and we've recently updated the distribution to require HTTPS between CloudFront and viewers. With the introduction of AWS Certificate Manager and the ...
6
votes
2answers
3k views

AMP Pages on HTTP or HTTPS?

Next month Google Search will integrate AMP pages. These are pages that are designed to work rapidly on mobile devices even when using a poor network connection. Should I host these AMP pages on a ...
6
votes
1answer
4k views

redirect various http domains to certain https domain via htaccess

I have a bunch of domain names with different TLDs. What I want is to point several domains to the "main"-domain which has a SSL cert (single domain). Like this: https://maindomain.com (main domain ...
6
votes
1answer
3k views

Redirect from SSL HTTPS to HTTP (NO SSL)

Many of my visitors have bookmarked my site already with https://mydomain.com. Under the bad advice of a programmer I have put my whole site (Joomla) using SSL. I do not sell anything or provide any ...
6
votes
3answers
107 views

Drop in referral data due to HTTP, changed to HTTPS no recovery referral data since (in the last year)

We changed our site from HTTP to HTTPS about a year ago. We have a static website, with no functionality for user input, so did not see it as an imperative to change to HTTPS anytime sooner, the ...
6
votes
2answers
2k views

What is the easiest reliable way to host a HTTPS enabled static page on a domain I own

I'm looking for a simple & reliable way to host a HTTPS enabled static page on a domain I own. The fist thing that came to mind was S3 static website hosting but there seems to be no way to enable ...
6
votes
1answer
4k views

Can I expect browsers to cache static content served over SSL encryption?

With all the talk about FireSheep I am thinking of switching my web applications to use full https accross the entire site. However, I am concerned about caching. I use a lot of JavaScript, CSS files, ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...

1
2
3 4 5
18