Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

HTTPS as a ranking signal

googleonlinesecurity.blogspot.com

Post reply on HN
Print view View original

11–20 of 212 posts

Re: HTTPS as a ranking signal

#11

Post by Nilzor »

hadoukenio wrote: post #8

A good move. Well done for pushing the world towards a safer internet. Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs? Hopefully Matt or any other Google search representative here can comment.

Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?

Re: HTTPS as a ranking signal

#12

Post by AdamN »

I'm all about this but what about third party static sites like everything on Github Pages? We're using Github to host http://kili.io which has all of our marketing material but there's no way to upload a certificate there. I'd rather not move off of Github Pages for the main site because it's easy to just push changes, it's fast, it makes it easy to tie into the rest of our open code (https://github.com/kili), and it's free.

Re: HTTPS as a ranking signal

#14

Post by tokenizerrr »

Nilzor wrote: post #11
hadoukenio wrote: post #8

A good move. Well done for pushing the world towards a safer internet. Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs? Hopefully Matt or any other Google search representative here can comment.

Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?

No. A plain cert is one you normally buy, an EV cert stands for Extended Validation which only specific CAs can give out and there's extra guidelines for that, plus they're generally much more expensive. Browsers generally show the identity of the certificate in the URL bar when they are EV, which they otherwise do not.

Re: HTTPS as a ranking signal

#15

Post by tristanperry »

jasonkester wrote: post #10

Makes sense. The reason seo spam is effective is because it's so cheap to get a new site (or ten thousand new sites) up and running. If you make that cost $50 per domain for the ssl cert, that will help ensure all those sites sift nicely down to the bottom of the rankings. Bonus points if they allow a single bad site to tarnish the reputation of all sites under a milti domain cert. We could have had this from the sta…

I do agree, however remember that you can get SSL certs from $9 (e.g. from NameCheap). You might be able to pay lower if you shop around too.

Also even if it was used as a fairly strong ranking signal, if Google still approach their rankings like they do now, spammers might still have sufficient ranking 'weight' to overcome a lack of SSL certificate.

Re: HTTPS as a ranking signal

#16

Post by ckuehl »

I'm interested in statistics (especially from websites with non-technical and international audiences) about what percent of visitors are using browsers/devices that don't support SNI.

I don't know how representative this is, but it looks like StatCounter Global Stats [1] says that slightly over 10% of recorded visitors are still using Windows XP, and many of these users won't have SNI support.

Small websites without strict security requirements often use shared hosting, where SNI is the only practical way to implement HTTPS. Alienating something like 10% of visitors with a security warning is probably not desirable. I imagine this could be a not insignificant roadblock to widespread SSL adoption on small websites, but would like to see more detailed stats.

[1] http://gs.statcounter.com/#os-ww-monthly-201307-201407

Re: HTTPS as a ranking signal

#17

Post by ayrx »

Nilzor wrote: post #11
hadoukenio wrote: post #8

A good move. Well done for pushing the world towards a safer internet. Quick question though. There was no mention of the type of certs used. Will plain certs be worth less than EV certs? Hopefully Matt or any other Google search representative here can comment.

Newb question: Is plain cert locally generated certificates (free), while EV certs are those you pay for from a "trusted authority"?

This link should explain the difference: http://security.stackexchange.com/q/15865/10211

Re: HTTPS as a ranking signal

#19

Post by wtbob »

My issue with SSL everywhere is that I have to effectively buy my domain twice: once for the domain, and one again for the certificate. My registrar should give me a wildcard certificate good for the time I've paid for my domain.
Post reply on HN