HTTPS or staying with HTTP?

[willbon]

OK... so who's going to transfer their site to HTTPS?

There's an old thread on here relating to this from 2014 with 2 updates in 2017... generally the view seems to be most won't bother changing...

https://www.acorndomains.co.uk/threads/google-to-use-https-as-a-ranking-signal.127914/page-2

...but as Google seems to be scoring more for https soon... is anyone planning to upgrade their sites?

 

[dee]

I think most people will wont they ? It's been a ranking factor for a while I thought now ? Certainly anything that involves payment needs it.

 

[Adam H]

Anyone not using it will be left behind.

https://searchengineland.com/effect...ill-mark-non-https-sites-as-not-secure-291623

 

[RobM]

We don't have a choice. Google has spoken. We are just subservient little cash cows and should know our place.

 

[martin-s]

You should have done this forever ago.

 

[alex]

I was at a conference on Tuesday where they spoke about GDPR. Apparently encryption is not a requirement of GDPR, but companies need to be able to demonstrate reasonable effort to mitigate privacy breaches, else if they are investigated by the ICO they are more likely to be liable to fines. I therefore assume that SSL will become all the more important from that perspective even if you don't care about Google's recommendations from an SEO perspective.

 

[RobM]

Yet if you have a single page with no input boxes you *still* need an SSL certificate.....

 

[willbon]

Thanks for the responses everyone....

appreciate your input..... I'll start another thread and if you have any advice on HOW to do it... I'd be grateful...

Thanks!

New thread here.....
https://www.acorndomains.co.uk/threads/https-migration-tips-and-suggestions.153120/

 

[Ben Thomas]

Use LetsEncrypt for domain verified SSL certs and it will cost you nothing. Everyone should be moving over HTTPS by now.

 

[RobM]

Why should someone who doesn't gather any data or have any input move to https? Because google tells you to?.... People shouldn't all so blindly follow and quote someone forcing them to make unnecessary changes. It's frightening how malleable people have become.

 

[Ben Thomas]

Why should someone who doesn't gather any data or have any input move to https? Because google tells you to?.... People shouldn't all so blindly follow and quote someone forcing them to make unnecessary changes. It's frightening how malleable people have become.

No, I think before Google started pushing HTTPS (which is fairly recent) people should have adopted SSL. It's not just about that, it's about gathering trust and having security online, whether you run a one page static or a full CRM with millions of customers data, it should be the same. It would be nice to see a 100% SSL internet.

But, I guess old habits die hard and people don't like change.

 

[RobM]

Why do you need to 'gather trust and have security' for a static one page site not receiving any input?

 

[Ben Thomas]

If you're a company who sells things over the phone or in-store, if you went to their website and saw it as unsecured, would you think "Very professional company" or would you think "Unprofessional, can't even afford to secure their website".

 

[RobM]

So basically someone who wouldn't have a static one-page site with no input? So really there is no actual need to 'gather trust and have security' is there?
To me it's the same as the government saying that as of tomorrow *everyone* has to wear wellington boots, a raincoat, and take an umbrella out every day because somewhere in the world it is raining. Oh and if you don't you'll be put in jail. Some people would be happy with that I guess.
The point is *choice*. When that is taken away for everyone for no benefit and some people think that's a good thing I worry. Especially when they don't seem to understand what's behind it.

 

[Adam H]

Why do you need to 'gather trust and have security' for a static one page site not receiving any input?

You don't, that's entirely your decision as the website owner. But as of July this year all mainstream browsers will mark "ANY" website, whether its a single page with no form fields in or not...As not secure. If you are in any niche where there is a chance of a customer being spooked by such warnings then its advisable to switch.

 

[RobM]

You realise there's no need to do that? You're ok with that? BTW we won't even get into letsencrypt and how half the time their automatic updates don't work causing you actual downtime you don't need for a certificate you don't need. I'm sure in a few years the only certificates that will be acceptable are googles own... and they won't be free. You can already see how they're heading with their built-in adblock and still people are ok with that. Scary.

 

[Ben Thomas]

I see your point, Rob. I accept that it is valid, but in reality, the whole world is heading this way. What harm can SSL do? Also, I really don't think in any acceptable world, Google would be able to hand out SSL exclusively. It would not be morally ok and people would reject Google.

 

[RobM]

And yet they won't reject them when forced to do other things...clearly.

 

[Ben Thomas]

Such as?

 

[Adam H]

You realise there's no need to do that? You're ok with that? BTW we won't even get into letsencrypt and how half the time their automatic updates don't work causing you actual downtime you don't need for a certificate you don't need. I'm sure in a few years the only certificates that will be acceptable are googles own... and they won't be free. You can already see how they're heading with their built-in adblock and still people are ok with that. Scary.

I realise there is no need, I'm ok with you not wanting to do it, you have your reasons.....I couldn't give a monkeys who wants to and who doesn't want to. But if someone wants an opinion from me, and I think it would be of benefit to them in some way or another. I personally won't be saying "no don't do that, you'll be seen as a sheep by that Rob bloke at acorn."

Best part of two years and hundreds of websites later, I've never seen a problem with their auto renewals that's been through fault of Let's encrypt, the few that did experience auto renew problems were faults with my configuration mishap when moving expired paid certs to Lets encrypt. Maybe I was just lucky