HTTPS as a ranking signal • Hacker News Board

Re: HTTPS as a ranking signal

#101

Post by CalRobert » Thu, Aug 07, 2014, 10:51 AM UTC

Tomte wrote: post #91

CalRobert wrote: post #84

This wouldn't be so bad if there were more support for CAcert. It's great news for the commercial certificate authorities, though.

After some interaction (including assuring people), my impression of CAcert is much more negative than my impression with any of those big bad CAs everyone likes to complain about. They are so far off this side of "sane" it's really not funny.

Are you able to elaborate? If not that's fine, but I just don't think paying for a cert makes it somehow better, so I liked the idea of CAcert. If I should be concerned about using them to secure personal sites (in this sense really only used by myself and a few friends who have the CA root cert) I'd be interested in knowing.

Re: HTTPS as a ranking signal

#102

Post by nulltype » Thu, Aug 07, 2014, 10:51 AM UTC

drdaeman wrote: post #87

chmars wrote: post #72

Earlier quoted context omitted.

Another advantage to we masters with money … why? SSL does not come cheap. Certificates have become cheap but you need your own IP, i.e., shared hosting is a problem and hosting becomes more expensive. Certificate sellers, hosters etc. on the other hand are certainly happy about these new business opportunities – although we all know that SSL is inherently broken. OK, probably still better than nothing! :)

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

Except with the most popular version of Python

Re: HTTPS as a ranking signal

#103

Post by netforay » Thu, Aug 07, 2014, 10:54 AM UTC

But this site is still on HTTP. When I tried HTTPS it redirected to HTTP. Even they are not ready it seems.

Re: HTTPS as a ranking signal

#104

Post by madaxe_again » Thu, Aug 07, 2014, 10:57 AM UTC

Smerity wrote: post #43

Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1]. Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google…

Sorry to jump in with a tangential reply, but BEWARE of the following!

Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant.

You can verify this behaviour for yourself in webmaster tools.

I suppose this is because it's possible to serve up different content on http/s, but really, who does that?!

In short, don't do this until google rethink their stance on what counts as a property. I'm currently nursing a client with a 30% revenue hole as a result of this.

Re: HTTPS as a ranking signal

#105

Post by guruz » Thu, Aug 07, 2014, 11:04 AM UTC

franze wrote: post #46

upside: security, further migration to HTTP/2 easier (when it's ready) downside: HTTPS negotiation time overhead (slower website) (as long as we use HTTP 1.1), costs (certificate, technical migration) all in all i think it's a great move by google, thx

Only the first connection should be delayed a bit http://vincent.bernat.im/en/blog/2011-ssl-session-reuse-rfc5...

Re: HTTPS as a ranking signal

#106

Post by chmars » Thu, Aug 07, 2014, 11:09 AM UTC

drdaeman wrote: post #87

chmars wrote: post #72

Earlier quoted context omitted.

Another advantage to we masters with money … why? SSL does not come cheap. Certificates have become cheap but you need your own IP, i.e., shared hosting is a problem and hosting becomes more expensive. Certificate sellers, hosters etc. on the other hand are certainly happy about these new business opportunities – although we all know that SSL is inherently broken. OK, probably still better than nothing! :)

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

OK, good to know – although there are apparently still some restrictions according to comments by other HN users.

SSL is still more expensive, though. For most small content websites (Example:

Shared hosting with 4 WordPress blogs, SSL is active but only to access the control panel since the hoster allows SSL only for one domain. Costs incl. a cheap SSL certificate: 110 USD/year.

All 4 WordPress blogs with SSL, i.e., 4 shared hostings plus 4 cheap SSL certificates: 440 USD/year.

(And caching with a Wordpress plugin is probably no longer possible …)

Re: HTTPS as a ranking signal

#107

Post by chmars » Thu, Aug 07, 2014, 11:22 AM UTC

mike-cardwell wrote: post #78

radmuzom wrote: post #61

Earlier quoted context omitted.

In my country, the cost of a SSL certificate is around 60% of my hosting costs, per year. I run a low-traffic blog with comments disabled, so users do not "interact" with the site in any way - except consume the content. I don't see any benefit from this.

Get a free cert instead?

Free certificates tend to result in ugly warning messages in browsers …

Cheap certificates are available, however, they are still not for free. And hosting more than one domain with SSL is a problem too with most hosting providers if you do not want to book additional hostings.

Re: HTTPS as a ranking signal

#108

Post by diafygi » Thu, Aug 07, 2014, 11:37 AM UTC

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?

Re: HTTPS as a ranking signal

#109

Post by watwut » Thu, Aug 07, 2014, 11:47 AM UTC

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

They are free to get, but you have to pay money if you need to revoke that certificate.

Re: HTTPS as a ranking signal

#110

Post by speleding » Thu, Aug 07, 2014, 11:51 AM UTC

madaxe_again wrote: post #104

Smerity wrote: post #43

Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1]. Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google…

Sorry to jump in with a tangential reply, but BEWARE of the following! Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant. You can verify this behaviour for yourself in webmaster tools. I suppose this is because it's possible to serve up different content…

The Google blog says that TLS is a (presumably positive) ranking signal, they do not state whether leaving the site available unencrypted is a negative signal.

Until they clear up that ambiguity it seems risky to go TLS only for exactly the reason you cite.