everyone in this video we're going to cover all the ins and outs of securing
your website with HTTPS or secure socket layer x' this is becoming more and more
essential these days especially if you're gathering any sensitive
information whatsoever like emails and passwords from your users and passing
this information to and from your server this method automatically encrypts that
information keeping it safely out of the hands of nefarious hackers out there but
it's not just sensitive information like emails and passwords even if you've just
got a portfolio site or a run-of-the-mill blog HTTPS protection
can still be critical it encrypts and keeps your headers or URLs and other
contents confidential and keeps bad actors from injecting images scripts or
add content onto your pages which can definitely happen or worst case scenario
using your website to attack other sites or at the very least injecting code into
your web traffic which is not some far-fetched conspiracy theory even the
big service providers have been doing this to deliver their ads or to show
copyright notices and more not cool but HTTPS solves all of this mess it keeps
your content secure and helps you detect tampering Plus let's say that you have
applied encryption security just some of your most sensitive content that's all
well and good but by doing so selectively you're kind of putting
additional focus on that content hackers know where the diamonds are hidden but
by applying HTTPS security across all of your content you make those diamonds all
the more difficult to find ever heard of a man-in-the-middle attack this is when
two parties are communicating while an unknown third party listens in that
third party intercepts the communication alters it and then delivers it and the
two parties are none the wiser again this happens more often than you think
with ISPs for example let's say we have Karen who's at the airport and she looks
up bob's website on her phone's browser and maybe me as the ISP that is so
generously allowing Karen access to free Wi-Fi while she waits for her plane I
say you know what nothing in this world is really free so I'm gonna pop some ads
on to Bob's website when she visits it Bob will never know this and Karen will
simply think Bob some ads on his side but if bob was
using HTTP this wouldn't happen point is there are two huge misconceptions about
using HTTPS one is that it's only important for huge websites that pass a
lot of sensitive data back and forth like e-commerce websites or social media
platforms or sites that deal with payments but that's just not true
I mean hey some of us might still remember the days when we could leave
our front doors unlocked but that's just not the case anymore
and the same goes for online security more and more we're going to find that
the entire web is moving towards HTTPS as the gold standard it's already
required for many browser technologies like HTTP 2 and serviceworker api's
mozilla in fact just announced that effective immediately all new features
that are web exposed are to be restricted to secure contexts and nearly
all browsers are actively warning users not to use unsecure web pages so the day
will come when your website if you're not using HTTPS will be delivered to
users with that ugly warning which might quickly turn them away another
misconception is that HTTPS is difficult to setup also not true it's actually
very very simple and if all that isn't enough to convince you using HTTPS also
benefits your SEO for over five years now Google has been counting HTTPS as A+
PageRank signal and they've long encouraged everyone to use it so while
your competitors are still slow to this game it's yet another way to get a bit
of advantage over them in search results and again the best part is the process
is very simple to set up so let's get to it if you're not sure if
you've got this protection already well that's very easy to figure out just try
accessing your website with HTTPS instead of HTTP if you can then you're
all set if you get an error then you'll need to install and activate an SSL
certificate this can be done in five simple steps which we'll go over here
step one host your website with a dedicated IP address step two get an SSL
certificate step three activate it step four install it on your server and
Step five update your site to use HTTPS easy as pie but let's go through each of
these steps with you first of course let's assume that you have a registered
web domain where you're hosting your website most of us have validated our
domain rights a long time ago but just in case you haven't you'll need to
access one of the email addresses on your domains Whois record now a lot of
hosting platforms their economy packages can put you on a shared IP with other
websites but for the best ssl security you're going to want a dedicated IP
address this way you can make sure that the traffic going to that IP address is
only going to your website so if you have a shared IP
you're going to want to upgrade to a dedicated IP address but don't worry
this is usually very cheap with most hosting platforms either a small monthly
fee or a one-time setup fee now on to step two getting the SSL certificate you
can think of this as a driver's license for your site or an ID card basically
it's like a very long password that only your website knows and when someone
visits your site with HTTPS there's an instant verification process that occurs
does your website know the password yep then cool everything is automatically
verified and encrypted between you and the user now how you want to get this
SSL certificate is up to you if you want a robust security certificate then
you're best off buying one from a reliable CA or certificate authority
vendor preferably one with customer support and choosing a 2048-bit key
there's Verisign comodo GeoTrust didja cert quite a few out there and they all
have a wide range of price packages depending on what level of security
you'd like to apply purchasing from one of these reliable vendors is the
recommended approach if you want to ensure that you have the tightest
security but that said we all like to save a buck or two when we can so if
you're budget-conscious saying to yourself hey I thought this
SSL stuff was supposed to be easy now I've got to throw open my wallet and
start spraying cash everywhere well rest easy there are decent cheaper options
and even free options as well Namecheap offers SSL certificates at a
very reasonable price and let's encrypt org offers free certificates the last
for three months and the can be set to automatically renew so if
you've got a large e-commerce site that collects loads of customer payments and
other information then yeah you're going to want to invest a bit into getting
strong SSL certificate protection but of course if you've just got your little
blog on pickle recipes then no need to break the bank a free SSL certificate
should do the trick just fine okay once we have that sorted out and we have our
SSL certificate it's time to install it on our server unless of course your
hosting platform does that for you automatically if you've purchased it
through them many do but in the event you have to install it manually you're
going to need to log into your hosting account and create a CSR or certificate
signing request every hosting platform is a bit different of course but here in
mine in the security section under SSL TLS I'll find that option right here
I'll just need to fill out the required fields and click generate then I simply
copy the request code go to the vendor or wherever I purchased or created my
SSL certificate and paste it there next step install it on my side again if you
bought your certificate from your hosting platform then 99.99% chance this
is all done for you but if you need to do it manually just navigate to the
appropriate section in your hosting dashboard mine's here in the same
section and install it here with just a couple clicks and you're pretty much set
all secure now all that's left to do is to update your site so that visitors are
using HTTPS as well after all you might very well know to use HTTPS now but how
are they supposed to know so let's make this automatic for them the easiest
method we can simply update all of the links within our code to reflect the new
HTTPS protocol pretty cut-and-dried it's generally best practice to just run
HTTPS security on the pages of your site that need it and not necessarily waste
processing power and slowing down page load speed for no reason but this is
totally up to your discretion but let's say that we want users to use HTTPS for
our pages no matter what links they come from for instance from our HTTP links
that we have already spread out there on the web
for this it's best to do that on the server side of the equation to
accomplish this we can simply include this snippet of PHP code on top of any
page we'd like to secure or if you're comfortable doing a quick mod rewrite
you can just modify your configuration there with this code and there you go
safe and secure and it's something you can do in just a few minutes feel free
to check out our other videos so you can keep fine-tuning and getting the most
out of your SEO and click subscribe to stay updated with new tips and tricks to
get you to the top of the search engine results pages