Hot answers tagged

96

Update (February 27, 2019): Google have announced domain-wide data in Search Console, which combines all subdomains and protocols of a domain, http, https, www, and non-www. Old answer: Google Webmaster Tools treats HTTP and HTTPS as separate sites and you cannot inform Google using Google Search Console, that you moved from HTTP to HTTPS since the ...


85

Why should I pay for an SSL certificate? For most uses, there's no good reason to pay for them. See the very bottom for a summary of the exceptions. Let's take a step back and explain what certificates do and roughly how. What are commonly called "certificates" consist of two linked pieces: The certificate proper, which contains a public key and some ...


84

HTTPS does not just provide secrecy (of which you are doubting the value, though there are good reasons for it still) but also authenticity, which is always of value. Without it, a malicious access point/router/ISP/etc. can rewrite any part of your site before displaying it to the user. This could include: injecting ads for your competitors injecting ads or ...


49

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the case anymore using SNI. Lower cost and free security certificates. Let's Encrypt now issues about half of all certificates for free. Ten years ago I was ...


37

The address move tool does not support protocol changes Since HTTPS and HTTP are protocols you are not moving your site from one address to another, you are merely changing the URL path. Google Webmaster Tools does not support address moves on changes to the URL paths including sub domains, and protocols. SOURCE Request an address change. ...


34

Your proposed solution is the best way forward from an SEO perspective. You avoid duplicate content by using the canonical URL and the 301 redirect will transfer most of your PageRank (a small amount is lost in the redirect). Plus thanks to the strength of Stack Overflow's pages in Google I would be more then stunned if you saw any fluctuations in your ...


34

The 'green box' in the Chrome address bar isn't anything to do with verification by Google - as Stephen alluded to in the comments on your question, it's an indication that your site has an Extended Verification (EV) security certificate. This is generally a 'premium' SSL product offered by many SSL certificate providers. To get one of these certificates, ...


33

It should be noted that the following list has not been updated since November 2014. The following browsers do support SNI: Internet Explorer 7 or newer, on Windows Vista or newer. Mozilla Firefox 2.0 or later Opera 8.0 or newer (TLS 1.1 protocol needs to be enabled) Opera Mobile with at least version 10.1 bèta on Android Google Chrome (Vista or newer. XP ...


32

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image in transit and thereby change how your otherwise secure page looks to your users. Instead you could use any of the following to serve the images securely: Link ...


30

As Tim Malone said, this is a special type of SSL certificate that is usually sold at a premium by certificate authorities. The going rate is usually at least a couple of hundred dollars. What Tim did not mention, and part of the reason for the elevated price, is that there is a certain amount of paperwork involved that has to be submitted to and checked by ...


26

I have some bad news for you. StartSSL's certificates are no longer trusted by Chrome, Firefox, and soon other browsers, beginning with newly issued certificates first. StartSSL won't tell you this of course and will happily sell you new certs, continuing their extremely shady pattern of behaviour. At this point all I can recommend is damage control by ...


25

"nothing secret on the site" ...According to you. There migh be a perfectly fine reason someone wants a secure connection. It (partly) creates privacy: My admin can see that I'm browsing some picture site on my phone via url, but he can't tell if I'm watching pics of cute cats or hardcore porn. I'd say that's pretty damn good privacy. "a content" and "...


19

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how important HTTPS actually is: Firesheep allowing session hijacking, and the Tunisian government intercepting Facebook logins to steal credentials. Firesheep was a ...


16

PLEASE NOTE THE EDITS & UPDATES BELOW As of me writing this (May 23 2012), SSL is supported via the CloudFront distribution URL only. Meaning, you cannot CNAME the SSL URL. Concretely, you can reference an item via SSL as: https://[distribution].cloudfront.net/picture.jpg but not: https://cdn.mydomain.com/picture.jpg where cdn.mydomain.com is a ...


15

I think this question deserves a bit more background... There's different types of SSL/TLS certificates that can be issued by a Certificate Authority (CA), who basically acts like a notary, certifying that the domain you're accessing, is really the real site, and you're accessing it securely. When you access a site that uses HTTPS, the site's server will ...


14

I've supported HTTPS on my websites for about two years now, but I'm just starting to experiment with the HTTPS versions in search engines. For my sites, I have always had the HTTP version as the canonical (using link rel canonical tags) but allowed users to navigate to either HTTP or HTTPS. On March 18th, I switched that for one of my sites. I made ...


14

UPDATE Sept-2019: Google's recent changes to Google Search Console has made my original answer (below) a bit outdated and in some respects incorrect. You can now submit two different types of properties in GSC: "URL-prefix property", which is the same as the property type mentioned here. In this case you would still submit all variations as required, ie ...


13

There is no way to do it in robots.txt itself as served over HTTP. You could serve a different robots file entirely for secure HTTPS connections. Here is one of doing so using rewrite rules in your .htaccess file: RewriteEngine On RewriteCond %{HTTPS} =on RewriteRule ^robots.txt$ robots-deny-all.txt [L] Where robots-deny-all.txt has the contents: ...


13

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to detect man in the middle attacks. To authenticate itself against a client the server needs for this the certificate itself which is public and the private key ...


12

You get HTTP/2 support, the new web standard designed to significantly improve website loading speeds. Because browser makers have chosen to support HTTP/2 only over HTTPS, enabling HTTPS (on a server that supports HTTP/2) is the only way to get this speed upgrade.


12

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they decided to convert the loss into value by showing efforts of securing their products. So instead of losers they show up as leaders. They needed real efforts ...


11

About a year ago there was a bug in the permalink generating code for my WordPress site, which gets about 70% traffic from Google. The canonical tag started using the WP short URL format instead of the regular format. Two weeks later, I found the bug when I noticed that my URLs were showing weird in the Google index. Instead of the full /999999/post-url-...


11

When you buy a SSL certificate, it is not tied to any particular IP address. It can be used on any server that hosts the content for that domain name. I personally have a load balancer on my website with multiple servers behind it. I have the same certificate installed on each of the web servers that are behind the load balancer. Each of those servers has ...


11

Typically, user agents wouldn’t dereference these URIs. There should be absolutely no problem in using the Schema.org HTTP URIs on a HTTPS site. In fact, many other vocabularies (used for Microdata or RDFa) provide only HTTP URIs, so you have no choice there. I’d even say it’s bad practice to provide multiple vocabulary URIs for the same concept, as ...


11

I found the solution. Without HSTS (single redirect): RewriteCond %{HTTP_HOST} !^www\. RewriteRule .* https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301] RewriteCond %{HTTPS} off RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] With HSTS (double redirect): RewriteCond %{HTTPS} off RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] ...


11

Why not get a free SSL certificate from Lets Encrypt, then your https will work. Ride the horse in the direction it is going...


10

SSL certificates no longer require a dedicated IP address. There is a relatively new technology called Server Name Indication (SNI) that allows SSL certificates to be associated with a virtual host rather than with the server's IP address. Here is a digicert article that explains it very well. Your host may not have SNI support installed yet. It ...


10

You need to drop the 'http:' prefix from all image (and any other) links on your site. When you do so, your browser will default to whatever protocol the page loads with. For example this is best: <a href="//www.example.com/"> And this is not: <a href="http://www.example.com/"> The top example is perfectly valid markup and you will load all ...


10

If you are moving your site from HTTP to HTTPS, you will need to submit the HTTPS site as a new site (defined as new property). I was advised that I did not need to do this, however Google WMT stopped reporting index status, crawl errors and traffic. Once I added the HTTPS to Google Webmaster Tools I started receiving correct data within the Google's WMT ...


10

You need to add a new site on Google Webmaster Tools and set the domain as https://example.com all the data is being collected there instead.


Only top voted, non community-wiki answers of a minimum length are eligible