Secure your site with HTTPS

Protect your site and your users

If you already have a website and wish to migrate it from HTTP to HTTPS, follow the instructions in the Site Moves with URL Changes. The rest of this article describes HTTPS and best practices for using it.

What is site security?

You can make your site secure with HTTPS (Hypertext Transfer Protocol Secure), which protects the integrity and confidentiality of your users' data. For example, when a user enters data into a form on your site in order to subscribe to updates or purchase a product, a secure site protects that user's personal information and ensures that the user communicates with the authorized owner of the site.

Why make your site secure? Users expect a secure online experience when providing data via a website. We'd like to encourage you to adopt HTTPS in order to protect your users' connection to your website. The remainder of this document provides high-level guidelines on how to make your site secure.

How does HTTPS work?

With HTTPS, information is secured via Transport Layer Security protocol (TLS), which provides three key layers of protection:

  1. Encryption—encrypting the exchanged data to keep it secure from eavesdroppers. That means that while the user is browsing a website, nobody can "listen" to their conversations, track their activities across multiple pages, or steal their information.
  2. Data integrity—data cannot be modified or corrupted during transfer, intentionally or otherwise, without being detected.
  3. Authentication—proves that your users communicate with the intended website. It protects against man-in-the-middle attacks and builds user trust, which translates into other business benefits.

Best practices when setting up HTTPS

Use robust security certificates

You obtain a security certificate as a part of enabling HTTPS for your site. The certificate is issued by a certificate authority (CA), which takes steps to verify that your web address actually belongs to your organization, thus protecting your customers from man-in-the-middle attacks. When setting up your certificate, ensure a high level of security by choosing a 2048-bit key. If you already have a certificate with a weaker key (1024-bit), upgrade it to 2048 bits.

When choosing your site certificate, keep in mind the following:

  • Get your certificate from a reliable CA that offers technical support.
  • Decide the kind of certificate you need:
    • Single certificate for single secure origin (e.g. www.example.com).
    • Multi-domain certificate for multiple well-known secure origins (e.g. www.example.com, cdn.example.com, example.co.uk).
    • Wildcard certificate for a secure origin with many dynamic subdomains (e.g. a.example.com, b.example.com).

Help search engines see your site as secure

  • Redirect your users and search engines to the HTTPS page or resource with server-side 301 HTTP redirects.
  • Use relative URLs for resources that reside on the same secure domain.
    For example, use <a href="/about/ourCompany.php"> to refer to a page on your site example.com, rather than <a href="https://example.com/about/ourCompany.php">. Doing so ensures your links and resources always use HTTPS. It also has the side benefit of making local development less error prone because images, pages, and other resources are loaded from your local development environment instead of the production environment.
  • Use protocol relative URLs for all other domains (e.g. //petstore.example.com/dogs/biscuits.php), or update your site links to link directly to the HTTPS resource.
  • Use a web server that supports HTTP Strict Transport Security (HSTS) and make sure it's enabled.
    This mechanism tells the browser to automatically request pages using HTTPS even when the user enters http in the browser location bar. It also tells Google to serve secure URLs in the search results. All this minimizes the risk of serving unsecured content to your users.

Common pitfalls in using HTTPS/TLS

Throughout the process of making your site secure with TLS, avoid the following mistakes:

Issue Action
Expired certificates Make sure your certificate is always up to date.
Certificate registered to incorrect website name Check that you have registered your certificate to the correct host name. For example, if you register the certficate for www.example.com and your website is configured to use example.com, you'll have a certificate name mismatch error.
Missing Server name indication (SNI) support Make sure your web server supports SNI and that your audience uses supported browsers, generally. While SNI is supported by all modern browsers, you'll need a dedicated IP if you need to support older browsers.
Crawling issues Don't block your HTTPS site from crawling using robots.txt.
Indexing issues Allow indexing of your pages by search engines where possible. Avoid the Noindex meta tag.
Inconsistent linking from HTTPS to HTTP URLs on your site Use protocol relative URLs (e.g. //example.com/script.js instead of http://example.com/script.js)
Old protocol versions Old OpenSSL versions are vulnerable; make sure you have the latest and newest versions of TLS libraries.
Mixed security elements Only embed HTTPS content on HTTPS pages.
Different content on HTTP and HTTPS Make sure the content on your HTTP site and your HTTPS is the same.
HTTP status code errors on HTTPS Check that your website returns the correct HTTP status code. For instance 200 OK for accessible pages, or 404 or 410 for pages that do not exist.

For more details on how to implement TLS on your site, see the following resources:
Qualys SSL/TLS best practices
SSL/TLS Mozilla wiki