HTTPS: secure web

Still a lot of websites, often even e-shops, do not have a secure website. That's why I decided to explain why to have a secure site using HTTPS and SSL certificate and how to do the redirection from HTTP to HTTPS correctly.

View details about site security using SSL certificate and HTTPS:

Don't you have a secure site yet?

Motivation not to delay with HTTPS:

1. Security (HTTP anyone can read the content including passwords
2. Better for SEO
3. GDPR - you are required to ensure security
4. Chrome HTTP marks sites as "insecure" as of July 2018

What is HTTP(S)

HTTP is typically run on port 80.
HTTPS is typically run on port 443.
What is HTTP (HyperText Transfer Protocol).
What is HTTPS.

SSL, TLS

What is SSL? Today, the more modern TLS is already in use.

Video

Video with information on how to secure a vec using SSL certificate and HTTPS and how to redirect from HTTP to HTTPS correctly

Certificate

Setting up a certificate:

• commercial, possibly EV
• Let's Encrypt - has API

Redirect to HTTPS

Migration procedure:

1. get a certificate
2. enable the HTTPS protocol
3. check site functionality
4. redirect HTTP to HTTPS

View certificate details:

When HTTP is redirected to HTTPS, it is a URL change. It is a bulk URL change. Which can affect results, but if it is done professionally, search engines no longer have a problem with it today.
Thanks to SNI, multiple sites with different certificates can be run on one IP without any-problems. Of course, where you have an old system with an old webserver, SNI is not supported. In this case, I recommend changing hosting or upgrading the webserver.

How to get the web wrong?

You're hurting yourself if you're running on both HTTP and HTTPS without redirecting to one specific canonical URL

How to do redirects right

Example from my site https://www.josefjebavy.cz: So everything: https://josefjebavy.cz, http://www.josefjebavy.cz, http://josefjebavy.cz without intermediate steps redirects directly to https://www.josefjebavy.cz .

.htacces

Example of redirection for apache web server using mod_rewrite module. Configuration written to the .htaccess file:

# redirect from http to https
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Further Security

To increase the security of your visitors, you can also deploy HTTP Strict TransportSecurity.