Today, you're going to learn everything you need to know about HTTP vs. HTTPs.
We'll talk about the difference between these two protocols, how SSL and TLS
encryption work, where you can get a free SSL certificate and why you might not want to do
that, and we'll finish things off with finding and fixing HTTPS related issues on your website.
Let's get started by defining HTTP.
HTTP stands for hypertext transfer protocol, which is basically a method
to fetch resources such as HTML documents and images.
For example, when you submit a request by entering a URL in your browser's address bar
or by submitting a form on a page, a request is sent from your computer
to the website's server.
And that data will travel through the internet as plain text until it reaches the server where
the website is hosted.
The server will then send back a response to that request and
your browser will render, or show that data the way it's intended.
Now, everything seems well and good, but the problem happens when we add
hackers to the equation.
Because the information is sent as text, attackers are able to intercept
and extract potentially sensitive information while it travels to and from web servers.
So that might be things like your name, usernames, address, credit card number,
and passwords.
That's where HTTPS helps.
HTTPS is basically HTTP but with security features.
And you can tell whether a website is using HTTPS by looking for a lock icon
in the address bar.
Now, when you submit your request via. HTTPS, that information is encrypted
before it travels across the internet to the web server.
So when an attacker intercepts that data, they won't know the details of
your request to the web server because the information will be scrambled.
And they also won't know the response that the web server sends back because
that too is encrypted.
HTTPS is now the main protocol for transferring data across the web
because it protects people's information from being compromised.
In fact, HTTPS is so important for keeping web users safe that Google
made it a ranking signal in 2014.
And more recently, it's been categorized under their page experience signals
which are used for ranking web pages.
Now, if this was tough to understand, it may be easier to envision sending
a package through the mail.
When you drop off a package at the post office, technically, anyone can open your
package, steal the contents, or tamper with them.
This is like HTTP.
Now let's rewind.
Let's say that your package contents are enclosed in an indestructible safe.
Sure, people can remove the packaging, but only the people with a key will be able
to see what's inside the safe.
That's like HTTPS.
Now, the way HTTPS secures your data is by using one of two cryptographic protocols.
SSL or TLS.
SSL stands for Secure Sockets Layer.
And it helps to authenticate the identity of a website so a secure HTTP session
can happen between the client and the server.
Here's how it works in a nutshell.
When you try to connect to a website that's using SSL, the browser asks
the server to identify itself.
This process is known as authentication.
The browser essentially says to the server, "Hey... I'm looking for x.com.
I think that's you but I want to be sure.
Can you send me some proof?"
So the server will be like, "Howdy!
Yep, that's me and here's my SSL certificate to prove it."
And when both parties are happy that everything looks legit, they'll do a virtual
handshake and agree to send encrypted data to one another.
Now, TLS is the second cryptographic protocol.
TLS stands for Transport Layer Security and it's actually the successor of SSL.
It follows the same principles in authentication and encryption and
is today's current security standard.
Now, if your website isn't using HTTPS, then you'll need to get an SSL or TLS certificate.
And while basically anyone can issue a certificate, only publicly trusted CAs,
or certificate authorities, are supported by browsers.
So let's talk about how to get a free SSL certificate and also discuss why
you might want to pay for one instead.
So there are three different types of certificates you can get.
The first is a Domain Validation certificate or DV.
This is your entry-level TLS certificate and it provides the most basic level
of security.
You can get one for free at LetsEncrypt.org and follow
their directions to install it.
Alternatively, your web hosting company may already have a user-friendly way
to install an SSL with a free service provider like Let's Encrypt.
For example, in Siteground's Site tools, you can install a Let's Encrypt SSL for
your domain with just a few clicks.
DV certificates are usually fine for most sites, especially if you're
running a blog, affiliate site, or if you're a local service provider.
Now, if you want to have more security and better identification, then you'll have
to look to the other two types of certificates which are organization
validation and extended validation – the latter having a more rigorous
verification process.
You can purchase these through various sites so shop around if you need one.
Alright, now let's talk about handling HTTPS issues because they are common.
If you started your site on HTTPS, then you shouldn't have anything
to worry about.
But chances are, we didn't all start there, meaning, there could
potentially be pages across your site that are still using unsecure HTTP.
In fact, even Amazon, the world's largest Ecommerce site, has an entire subdomain
that's still using HTTP.
Now, there are numerous ways to check for HTTPS issues.
One quick thing you can do is see if Google knows about any of your
unsecure URLs.
To do that, go to Google and search for site:yourdomain.com and then
add -inurl:https.
If there are no results then you're all good on this front.
But if you're seeing results like this, then you'll have to visit each page
and add redirects or canonicalize as needed.
In the case of Amazon's Development Center for Romania, there is indeed an issue.
Now, if we go back to the SERP and click on another result,
you'll see that it automatically redirects to the secure version.
And that's because this query isn't about finding unsecure
pages that are indexed in Google.
It just means that Google knows that these pages were once unsecure, so
you may get some false positives.
So to avoid wasting time, the best way to find all HTTPS related issues is to run
a website audit.
And you can do that in Ahrefs Site Audit with a paid or free
Webmaster Tools account.
After you've run the crawl, head over to the "All Issues" report and you'll see
a complete list of SEO issues we found on your site and the number
of affected pages.
Now, if you do a search for HTTP, you'll see this issue, which shows that we
have seven pages on our site where HTTPS pages have internal links to HTTP pages.
Hit the caret, and you'll get details on the issue and instructions on
how to fix them.
Now, to actually see which URLs are affected, just click on the number
beside the issue name, and you'll know exactly where these issues occurred.
HTTPS is the standard and as more and more people become aware of internet
security, you'll need to have this for your website as the bare minimum.
So go and do that and if you want to learn more about search engine
optimization, we have a full course that'll teach you how to get more
organic traffic to your site and keep your site in good technical health.
I'll see you in the next tutorial.