7 HTTPS Implementation Mistakes
With a large number of sites coming under an increasing number of attacks, users are now coming around to understanding the need for preferring sites that are secure.
Google even stated this to be a ranking factor in 2017 so it's a preferred factor we encourage all our Gold Coast SEO clients to implement on their website.
HTTPS is slowly moving away from being an option to something that will become the de factor filter of users while choosing a service or product.
Now that we have got this little fact of matter behind us, it is time to go granular.
Most websites suffer from implementation glitches that will prove to be expensive. It is, therefore, necessary to ensure that some mistakes are avoided, and those that are made, be rectified at the earliest. Here is a roundup of some most common mistakes.
1. Mixed Content:
Pages that have too many HTTP connections render their corresponding HTTPS insecure. This is something that will not only affect the security of the website but will also create an unsecured image of your website in the minds of visitors because browsers are advanced to levels where notifications are instantly shared with users about unsecured content.
2. Security Certificate Errors:
SSL certificates are important in that they establish a secure connection between a server and browser. This secure pathway prevents data from being stolen. An expired SSL certificate will raise a red flag, warning users about the expiry, and invariably this will result in users having second thoughts about continuing their sessions on the website.
3. Improper Redirects From URLs To HTTPS Site:
A significant percentage of websites do not properly redirect URLs to HTTPS. It is important to note here that the switch, from HTTP to HTTPS should include canonical pages to ensure that redirects are put in place.
4. Incorrect Registration of SSL Certificates:
This is another typical mistake committed by an equal number of websites. Here, the domain name and the SSL certificate remain mismatched and this also runs the risk of violation of the terms of certification if names are not suitable.
5. Mandatory HSTS Support:
It is mandatory to implement HSTS (HTTP STRICT TRANSPORT SECURITY) to prevent the transmission of unsecured content to recipients. This policy mechanism offers protection to websites from downgrade attacks and cookie hijacking attempts.
6. Absence of SNI Support:
Many websites fail to utilize Server Name Indication, a part of the TLS protocol which permits multiple secure websites to be serviced by one IP address. This needs to be implemented to enhance the confidence of users regarding the security of the site.
7. Compliance With DSS (Data Security Standards):
The PCI Council announced that TLS 1.0 (Transport Layer Security) and SSL (Secure Socket Layers) should no longer be used after 30 June 2016. Therefore, sites that run old TLS 1.0 and SSL protocols need to upgrade to the latest protocol versions.
References:
https://www.semrush.com/blog/https-implementation-mistakes-case-study/
https://www.ezrankings.org/blog/https-implementation-mistakes-that-hurt-seo/