HTTPS on the Rise - Why everyone must switch their site to HTTPS in 2017

If you talk to operators of larger websites today, you cannot avoid the topic of HTTPS. HTTPS is the encrypted variant (the S stands for "secure") of the Hypertext Transfer Protocol (HTTP). This is the protocol used to communicate in the World Wide Web (WWW) and transfer web pages to browsers.

Why is HTTPS not yet the standard?

When Tim Berners-Lee and others developed HTTP at the European Organization for Nuclear Research (CERN) in 1989, they could hardly imagine the current dimensions of the internet. Consequently, it was not yet necessary to encrypt the communication between servers and clients (browsers). The encrypted variant of the protocol was added only later. However, browsers today still assume unencrypted connections by default and normally add "http://" before the address if you enter a URL without specifying the protocol. In times of growing cybercrime and state surveillance, it is obvious that this is no longer contemporary. Anyone who has seen a live hacking demonstration by aramido and how easily a hacker can inconspicuously intercept browser communication as a Man in the Middle to read and manipulate content will understand why HTTPS is a sensible thing. Google, with Chrome as the market leader in the browser market, has now announced an important step for 2017. Every website operator will be affected by this step.

Browsers will display warnings for HTTP sites

In a blog post from September 8 of this year, Google announced that it will in the future display warning messages to users of the Chrome browser when visiting sites delivered unencrypted via HTTP.

Thus, from January 1, 2017, sites that request passwords or credit card data via HTTP will be marked with a warning message. In the long term, Google wants to clearly warn its users about all HTTP sites.

But even before Google's announcement, there were very good reasons why web servers should transfer page requests encrypted.

Google prefers encrypted pages in search results

Google had already announced in August 2014 that HTTPS would be included as a ranking factor in search algorithms. Since the announcement until July 2016, the share of HTTPS websites in search results has increased from an average of 7% to 30% according to a study by Moz. Although a large part of this is not algorithmically determined, but rather due to the fact that large providers followed Google's call. However, it still shows that the trend is clearly moving towards HTTPS by Default.

HTTPS is faster - really!

Slower speed is often cited as a reason against the use of HTTPS. This may be fundamentally true, as HTTP in version 1.1 works faster unencrypted than in the secure version. However, current browsers only support the new, faster HTTP protocol in version 2 for the encrypted variant of HTTP. Due to the fact that HTTP/2 over SSL/TLS (HTTPS) is several times faster than HTTP/1.1 without TLS (HTTP), websites over encrypted communication actually perform better in performance tests than if they are transferred unencrypted!

HTTPS certificates cost nothing

Especially for smaller sites, the costs for a TLS certificate were often a reason to forgo HTTPS. This has not been an argument since Let’s Encrypt provides free certificates for everyone.

The correct implementation is what matters

HTTPS should be a matter of course for new developments today. But existing web offerings must also deal with the topic of HTTP over SSL/TLS (HTTPS) now, at the latest, to avoid having to justify the delivery of insecure websites to their own users soon. Although the basic switch of a web server to HTTPS is not particularly difficult, there are still pitfalls to consider. This concerns, on the one hand, the correct setup of redirects from HTTP to HTTPS. In the past, large providers like Avira lost ground in Google rankings due to misconfigurations. Another difficulty with HTTPS relaunches are partner offers such as advertising networks, which are partly not yet delivered via HTTPS. Finally, a website that is delivered via HTTPS without corresponding HTTP Security Headers is not a real hurdle for a hacker . In case of doubt, one should always seek professional advice for such a project.