- Hi there, I'm Corey with HubSpot Academy.
In this video, we're going to cover how to get started
with HTTPS on your website and why it's so important
for website security.
But before we get started, don't forget to hit
that thumbs up button and subscribe to our YouTube channel
to stay up to date with more educational content
from HubSpot.
Ready to get started?
Let's kick things off by exploring some URLs.
Have you ever noticed that some URLs start with HTTP
and other start with HTTPS?
Perhaps you noticed that extra S
when you were browsing websites that require giving
oversensitive information like when you're paying
your bills online.
To put it simply, that extra S stands for secure.
This means that your connection to that website is secure
and encrypted.
Any data that you enter is safely shared with that website.
The technology that powers that little S
is one of two technologies, SSL or TLS.
SSL or Secure Sockets Layer
is the standard security technology for establishing
an encrypted link between a web server and a browser.
TLS is a newer technology that also authenticates websites.
TLS or Transport Layer Security is a protocol
that provides authentication, privacy and data integrity
between computer applications.
I won't go into detail about the technical differences
between SSL and TLS but just know that in many ways,
TLS has superseded SSL.
TLS is newer and arguably more secure but don't worry,
the certificates you use to implement both TLS
and SSL protocols are often interchangeable.
So from here on out, we're gonna look at solutions for SSL
and TLS together, since they're often one and the same.
Both of these technologies make sure that all data paths
between the web server and browser are private.
When you fill out a form on an unsecure website
and hit Submit, the information you just entered
could be intercepted by a hacker.
This information could be anything from details
on a bank transaction to high level information
you just entered to register for an offer.
In hacker language, this interception is often referred
to as man-in-the-middle attack.
The actual attack can happen in a number of ways
but one of the most common is this.
A hacker places a small, undetected listening program
on the server hosting a website.
That program waits in the background until a visitor
starts typing information on the website.
It will activate to start capturing the user's information,
like an account login and password
and then send it back to the hacker.
When you visit a website that's encrypted,
your browser will form a connection with the web server,
look at the certificate and then bind together
your browser and the server.
This binding connection is secure.
That means that no one besides you and the website
you're submitting the information to can see or access
what you type into your browser.
This connection happens instantly and in fact, many suggest
that it is now faster than connecting
to an unsecure website.
You simply have to visit a website with a certificate
and voila, your connection will automatically be secure.
There are a few ways to know if your website
has a certificate.
You can use HubSpot's Website Grader, the URL says HTTPS
and not HTTP.
You see a little padlock icon in the URL bar,
or the certificate is valid.
In your web browser, you'll be able to see if a site
is secure because it will say HTTPS
and you'll see a little padlock icon in the URL bar.
It'll show up either on the left or right hand side
of the URL depending on your browser.
You can click on the padlock icon to read more information
about the website and the company
that provided the certificate.
Even if a website has HTTPS and a padlock icon,
their certificate could still be expired,
meaning that your connection wouldn't be secure.
In most cases, a site that displays as HTTPS will be secure
but if you encounter a site that asks for a lot
of personal information, it may be worth double checking,
just to be sure.
To find out whether your certificate is still valid
in Chrome, go to View, Developer Tools.
From there, you will need to navigate to the Security tab
and you can see if this SSL certificate is valid or expired.
If you click the View certificate button,
you will be able to see more information
about the SSL certificate and the specific date
it's valid through.
So how can you get a certificate on your website?
The first step is to determine what type
of certificate you'll need.
For example, if you host content in multiple platforms,
on separate subdomains or domains, it may mean
that you need different certificates.
For most, a standard certificate will cover your content
but for companies in a regulated industry,
such as finance and insurance, it may be worth talking
with your IT team because there are specific requirements
within those industries that specify the type
of SSL certificate that you'll need.
The cost of certificates varies,
but you can get a free certificate
or pay a few hundred dollars per month
to obtain a custom certificate.
Let's Encrypt offers certificates at no cost
but the setup is technical, work with a web expert
to get it set up.
These certificates expire regularly, so you'll need
to make sure that they stay up to date.
Many other domain providers will sell certificates
that range generally from around $50 to obtain a certificate
for one domain up to a few hundred dollars
for multiple domains.
This process will be easier than using Let's Encrypt
but does have a cost associated with the certificate.
One of the other key considerations is the validity period
of a certification.
Most standard certificates that you purchase are available
for one to two years by default but if you're looking
for a longer term option,
then look into more advanced certificates
that offer longer time periods.
If you're using HubSpot, all Files hosted
within the HubSpot File Manager
are automatically encrypted with SSL.
With the HubSpot CMS Hub, you can direct all visitors
to the secure version of your site, no plugins required.
If you're using WordPress, there are many plugins
that can help you install your certificate,
Really Simple SSL, Insecure Content Finder
and WordPress Force SSL can be used
to install your certificate, encrypt files
and direct traffic to the secure version of your site.
Websites currently not on HTTPS will need to migrate
their site from HTTP to HTTPS.
Depending on the CMS that you're using,
this may be as easy as clicking a button
to download a certificate and redirect your pages.
For others, you might have to manually set up your redirects
to your new HTTPS URLs.
Check out the resources for some helpful guides
or work with your web team to set up a migration plan.
Beyond SSL, there are other ways that you can keep visitors
on your site safe.
There are front-end JavaScript libraries
with known security issues.
You should avoid these at all cost.
A front-end JavaScript library is a piece
of pre-written JavaScript which allows
for easier development of JavaScript-based applications.
But not all libraries are created equally
and intruders know this.
Intruders have crawlers that scan your site
for known security vulnerabilities.
When the website crawler detects a vulnerability,
it alerts the intruder.
From there, the intruder just needs to figure out how
to exploit the vulnerability on your site.
So scan your website with HubSpot's Website Grader
to identify if your page is using any JavaScript libraries
with known vulnerabilities.
To fix JavaScript library vulnerabilities,
you should stop using vulnerable
JavaScript libraries immediately, upgrade your libraries
to their newest version and continue using
if it fixes the vulnerability or use a different library
without known vulnerabilities.
To find which JavaScript libraries are causing you trouble,
we recommend following Google's resource.
I've linked to it in the resources.
You may need to work with a developer to help you find
which JavaScript libraries are causing you trouble.
Security is practically a requirement online.
Today, search engines will call out your web page
for not having an SSL certificate.
Search engines are taking their users' cybersecurity
into top consideration.
With an SSL certificate and by removing vulnerabilities
in your JavaScript,
you will keep your visitors' best interest at the forefront
of your website.
To learn more about how to create high performing websites
that drive traffic and convert leads,
check out HubSpot Academy's
free website optimization course.