Do you use a tls/ssl certificate and https on your sites?

[MichaelCorfman]

Google is paying increased attention to whether sites provide encrypted communication with users through the use of tls/ssl certificates (transport layer security is the successor of secure sockets layer) and https.

With the release of Chrome 56 last month, Google is flagging pages with password or credit card form fields as insecure if they don't use HTTPS. You can see an announcement of this in the Google Security Blog here: Moving towards a more secure web. In the article Google states it will eventually flag any page that does not use HTTPS as insecure and that the majority of pages viewed on desktops using Chrome are now done using SSL. It looks like Google wants websites to use SSL just like it wants websites to be compatible with mobile devices.

So, for this week's poll I thought I would ask members about their use of SSL certificates HTTPS. Do you use secure communications on your websites? Everywhere? In select locations? Do you plan to migrate to SSL if you have not already? And if you have done a migration, how easy or hard was the transition? I do have to give credit to this poll to q292u who made the following post earlier this month: Why isn't GPWA using SSL/HTTPS/Encryption?.

And if you do use HTTPS, you might also comment on what type of certificate you use, and why. There are three main types:

1. Domain-Validated Certificate proves the certificate holder is associated with the domain
2. Organization Validation Certificate adds to this by identifying a claimed organization associated with the domain
3. Extended Validation Certificate adds additional, much stronger, confirmation of the site operator

Domain-validated certificates can be very inexpensive (under $10) whereas extended validation certificates cost many times that much (as an example, pricing on Comodo for an EV certificate for three sites for two years is currently $525). Browsers do recognize the use of an EV certificate, and typically show the organization name and use the color green in the url display to indicate the site is secure. Especially for ecommerce sites, that can impact user trust and make a difference.

Michael

[DanHorvat]

Since most of my sites are on Plesk, I can use the free Let's Encrypt SSL certificate with one-click installation. So it's just a matter of making sure the redirects are in place, https is the preferred version in Google Web Tools, and that there's no mixed content. Pretty simple. But I haven't gotten around to doing that for all my sites. I do plan to, as I think of SSL as one of the basic stuff a webmaster should do to a site. It's a no-brainer.

Domain-validated certificates are good enough for most websites, as the goal here is just to change http to https so everyone's happy. No need for more expensive certificates unless you're actually processing payments.

A common problem is that affiliate programs aren't hosting their banners from a https location, triggering a mixed content penalty.

[DaftDog]

I use full ssl on all my sites. What ever it takes to rank a bit better.

[allfreechips]

Google is sending warnings to non https sites that have login or CC fields

[wonderpunter]

I use it on one of my sites.. cant say its help me rank any better

[superme]

Started to move all sites to SSL now on domain level only, for typical affiliate sites this is more than enough.

[sweetbet]

I don't use it on my sites because I don't use forms or accept payments.

[poc]

Agreed with everything you've said. There are now more and more casinos hosting banners from https. eg Casumo, Guts, Leov, Florijn and Jetbull. I am surprised some of the other big names haven't moved on this yet.

[Aidan90]

Been reading more and more about the SEO benefit of SSL lately but haven't taken the plunge - will keep a close eye on this thread to see other's opinions.

[celena]

I did not put my sites in https.
I just host my images in https.

[UTG]

I use AutoSSL on some of my smaller sites. My plan is to use it with my bigger sites as well, but the todo-list a bit too long at the moment. It was much easier than I expected to use AutoSSL through Serverpilot.

[Muppet]

A common problem is that affiliate programs aren't hosting their banners from a https location, triggering a mixed content penalty.

Another common problem that annoys me no end is affiliate programs that don't bother securing their own websites. They have potentially hundreds or thousands of affiliates logging in to sites over a plain text HTTP connection. Sure they only store personal information, bank accounts and other payment details, and many allow direct withdrawal of affiliate funds to new accounts. What could go wrong?

[MMM]

I started using on one. Can't say i see the difference to bother updating the old ones. But for new will go with https