HTTPS for Business Websites: Setup and Why It Matters

HTTPS for business websites means your pages travel between the visitor and your server in encrypted form. Visitors see a padlock in the address bar. Outsiders on the same network cannot read or change what is sent. To switch, you need a certificate, a server setting and a few checks. Since December 2015 the certificate can be free.

What the padlock tells a visitor

A normal web address starts with http. A secure one starts with https. The extra "s" stands for secure. When a browser connects over HTTPS, it asks the site for a certificate. The certificate proves that the site really owns its domain name. It also lets the browser and the server agree on a secret key, so the data in between is scrambled.

This matters most on pages where people type something private, such as a contact form, a login or an order. On plain http, anyone sharing the same café wifi could read that text. HTTPS closes that gap. It also tells visitors they reached your real site and not a copy.

Sources: Google Online Security Blog, "HTTPS as a ranking signal", August 2014; Let's Encrypt, "How it works".

Why Google cares

In August 2014, Google said it had started to use HTTPS as a ranking signal. Its tests showed positive results for sites that use encrypted connections. Google called it a "very lightweight signal" that affects fewer than 1% of global queries. It also said the signal carries less weight than others, such as high quality content. But it added that it may strengthen the signal over time, to encourage all site owners to move from HTTP to HTTPS.

So HTTPS will not rescue a weak page. Still, the direction is clear. A business that moves now avoids a rush later.

Sources: Google Online Security Blog, "HTTPS as a ranking signal", August 2014.

Choose a certificate

Google's own advice is to pick the certificate type that fits your site. A single certificate covers one domain name. A multi-domain certificate covers several names. A wildcard certificate covers every subdomain of one name, such as shop and blog under your main domain. Most small business sites need only the first kind.

Use a 2048-bit key, which is the size Google recommends. Your hosting company may sell certificates or install them for you, so ask them first. If you manage your own server, you can also get a certificate from a certificate authority yourself.

Sources: Google Online Security Blog, "HTTPS as a ranking signal", August 2014.

How to get a free certificate

Until recently, certificates cost money every year. That changed with Let's Encrypt, a free certificate authority run by the Internet Security Research Group. It moved into public beta on December 3, 2015, so no invitation was needed any more. On April 12, 2016, it left beta. By then it had issued more than 1.7 million certificates covering more than 3.8 million websites.

It works with software that runs on your server. The software proves you control the domain by placing a file on your site or adding a DNS record. Then it requests the certificate and hands it back to your server. Renewal repeats the same steps.

Let's Encrypt certificates last 90 days. The project explains that a short life limits the damage from a stolen key. It also pushes owners to automate renewal. It suggests renewing every sixty days. Set up the automatic renewal on day one, and put a reminder in your calendar as a backup.

Sources: Let's Encrypt, "Entering Public Beta", December 2015; "Leaving Beta, New Sponsors", April 2016; "Why ninety day lifetimes for certificates?", November 2015; "How it works".

Switch without losing visitors

After the certificate is installed, work through this list.

• Use relative URLs for images, scripts and styles on your own domain. Use protocol-relative URLs for files on other domains. This avoids warnings about mixed content.
• If your address changes from http to https, follow Google's site move guidelines so search engines learn the new address.
• Do not block the HTTPS version in robots.txt.
• Allow indexing, and avoid the noindex robots meta tag on pages you want found.
• Test your setup with the Qualys SSL Labs tool, and check speed worries with the "Is TLS fast yet?" site that Google points to.

Click through the main pages after the move. Fill in your own contact form once. If the padlock shows on every page, the job is done.

Sources: Google Online Security Blog, "HTTPS as a ranking signal", August 2014.

Sources

• Google Online Security Blog, "HTTPS as a ranking signal" (August 2014): https://developers.google.com/search/blog/2014/08/https-as-ranking-signal
• Let's Encrypt, "Entering Public Beta" (December 3, 2015): https://letsencrypt.org/2015/12/03/entering-public-beta.html
• Let's Encrypt, "Leaving Beta, New Sponsors" (April 12, 2016): https://letsencrypt.org/2016/04/12/leaving-beta-new-sponsors.html
• Let's Encrypt, "Why ninety day lifetimes for certificates?" (November 9, 2015): https://letsencrypt.org/2015/11/09/why-90-days.html
• Let's Encrypt, "How it works": https://letsencrypt.org/how-it-works/