As websites store more and more sensitive and personal information about visitors, concern about website security keeps growing.
A few years ago Google decided to encrypt its users' searches in its search engine, so that only someone browsing from their own account can see the keywords saved in their private history, without worrying that they will leak to unwanted parties.
Moving a website from HTTP to HTTPS. Original Hebrew article artwork.
Today Google's recommendation is that all sites across the web will move to to using a secure protocol (https), and it even publicly declared that secure sites will gain a certain ranking advantage, and it is very reasonable to assume that this advantage will grow in the future.
It is now easy to understand why data encryption on websites is becoming the standard today, and more and more site owners are purchasing security certificates in order to meet the growing demands of Google and of the visitors themselves.
However, moving to the https standard is not just a matter of buying an SSL certificate and installing it on the server; the move requires making many changes on the site so that everything meets the https standard.
In fact, it is enough for one of the elements on the page to be insecure for the entire page itself to be considered "Not secure".
In this guide we will explain how to make the move from http to https step by step, without harming your ranking score in search engines.
We installed an SSL certificate on the server side, which is the first and most important step, Now we will list the steps to take in order to maintain the search engine score:
1. Updating the dynamic links (search and replace in the database)
In order not to create broken links within the site or link to insecure versions of the pages (https), you must perform an action of Search and replace across all of the site's content and replace every a link starting with http to a link starting with https.
Fortunately, today most of the content in content management systems (for example WordPress) stored in databases, so this replacement function can be performed with a few simple commands in a database management tool (for example, PHPMyAdmin).
uPress customers: it is possible to run a search and replace under the management interface. Select the desired site > under the Development tab > More hosting tools > Search and replace in database.
2. Updating the static links (in code files)
In most sites that were custom-developed (and not using a standard theme) there are fixed parts located in files such as functions.php, header.php and style.css which were edited by the site developer or the site owner.
In many of these files there are Code snippets that use insecure links, and therefore it is mandatory to replace them with secure versions (except for parts that use variables located in the database, which we already replaced in the previous section).
3. Checking the source code
Make sure there is no trace of insecure links on your site by Scanning the source code files of the site – pay particular attention images, CSS files and JavaScript files.
To view your site's source code files, go to the site in the browser you usually use > right-click on the page content > View source.
4. Browser indication
The sign of a green padlock in the browser's address bar shows that all the links and the various elements on the current page are secure. If a green padlock does not appear on all the pages we wanted to secure, it means we still have insecure links and we must repeat steps 1-3.
5. 301 redirects
In the htaccess file, you must add a 301 redirect from the insecure version to the secure version of each page.
This ensures that any external link to the site will not harm the site's security, and that Google will also update its index accordingly.
Ultimately, we need to reach a situation where all site URLs redirect to the secure version of the site (https), so that even if we try to access a certain page without the https prefix, we are redirected to it automatically – this is similar to a permanent redirect to the www or non-www version of the site.
You can add the following code to the .htaccess file located in your site's home folder (public_html):
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.co.il/$1 [R,L]
Note that you should replace www.example.co.il with your site's real address.
uPress customers: All you need to do is enable the option of Redirect all traffic from http to https > under the Security.
6. Canonical tags
In the same way, you should include the tag rel=canonical that points to the page's absolute address with https using a full link (https://www…).
The meaning of this tag is to prevent a conflict in search engines that encounter two versions, and to tell the search engine that the decisive and useful version is the https version.
7. Scanning enabled
Make sure that all https pages are crawlable and not blocked by a noindex tag or by the robots.txt file. To verify this, you can use the "Fetch as Google" tool located in Google Search Console. crawlable and not blocked by a noindex tag or by the robots.txt file
To verify this – you can use the "Fetch as Google" tool, which is located in Google Search Console.
8. Sending a request to update the sitemap
In Google Search Console, you must update the the sitemap to one that includes the https links so that Google will crawl the updated versions more easily and quickly.
A few more things that are important to pay attention to:
1. Some browsers automatically treat insecure content on pages marked as secure as if it were secure (upgrade-insecure-requests), while other browsers such as Safari do not support this. Therefore, different results may be obtained in different browsers.
2. Don't forget to update both the Desktop and the Mobile versions of the site (if any).
3. If it is a very large site with various channels (ynet is a good example), it is advisable to make the transition gradually, category by category, to make sure everything works properly before moving on.
4. Some servers support a feature called HTTP Strict Transport Security, this feature ensures that the information passing from the site to the visitor and back is always secure regardless of what the visitor types in the address bar, and Google will also treat it as a secure site.
5. Every SSL certificate must be valid and linked to the site's full address. That is, if the site includes WWW, the security certificate must include WWW in the domain name, and if it does not include WWW, the certificate must also point to the version without WWW.
In summary
Moving to a secure protocol (https) is probably an obvious step that over time will reach all sites on the internet,
That said, switching to https requires a number of adjustments and changes in order to "stay alive". I hope I managed to convey in this article the steps that need to be taken and the importance of each one of them.
If you think I missed something – I would love to hear about it in the comments at the bottom of the article.
