HTTPS as a ranking signal • Hacker News Board

Re: HTTPS as a ranking signal

#111

Post by pierrefar » Thu, Aug 07, 2014, 12:00 PM UTC

madaxe_again wrote: post #104

Smerity wrote: post #43

Considering the importance of HTTPS to, in Google's words, "[making the] Internet safer more broadly", this seems like a good time to again suggest that Google enable HTTPS for Google Analytics by default[1]. Google Analytics is on 50.8% of the top million domains on the Internet, and on 26.96% of a randomly selected 48.5 million domains[1]. Of the 42 billion links analyzed in my research, over 48% of them had Google…

Sorry to jump in with a tangential reply, but BEWARE of the following! Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant. You can verify this behaviour for yourself in webmaster tools. I suppose this is because it's possible to serve up different content…

> Google treat the http and https versions of a domain as SEPARATE PROPERTIES.

That's not quite accurate. It's on a per-URL basis, not properties. Webmaster Tools asks you to verify the different _sites_ (HTTP/HTTPS, www/non-www) separately because they can be very different. And yes I've personally seen a few cases - one somewhat strange example bluntly chides their users when they visit the HTTP site and tells them to visit the site again as HTTPS.

> This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant.

That's not true. If you correctly redirect and do other details correctly (no mixed content, no inconsistent rel=canonical links, and everything else mentioned in the I/O video I referenced), then our algos will consolidate the indexing properties onto the HTTPS URLs. This is just another example of correctly setting up canonicalization.

By the way, if you're moving to HTTPS, following our site moves guidelines:

https://support.google.com/webmasters/topic/6033102?hl=en&re...

specifically, the site moves with URL changes:

https://support.google.com/webmasters/answer/6033049?hl=en&r...

But you did say you have a client with an issue. I suspect they either implemented the move to HTTPS incorrectly or something else is going on. Please ask for more help at our forums:

https://productforums.google.com/forum/#!categories/webmaste...

Re: HTTPS as a ranking signal

#112

Post by hadoukenio » Thu, Aug 07, 2014, 12:04 PM UTC

pierrefar wrote: post #53

I was involved in this launch and I want to address a very common misconception I'm seeing here and elsewhere. Some webmasters say they have "just a content site", like a blog, and that doesn't need to be secured. That misses out two immediate benefits you get as a site owner: 1. Data integrity: only by serving securely can you guarantee that someone is not altering how your content is received by your users. How man…

Hey Pierre,

Quick question. Is the type of certificate also a signal? i.e. self-signed vs plain vs EV?

Re: HTTPS as a ranking signal

#113

Post by icebraining » Thu, Aug 07, 2014, 12:05 PM UTC

nulltype wrote: post #102

drdaeman wrote: post #87

Earlier quoted context omitted.

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

Except with the most popular version of Python

Works fine if you use requests, or any other HTTP library which hasn't been left to rot like the one in the 2.x stdlib.

Re: HTTPS as a ranking signal

#114

Post by icebraining » Thu, Aug 07, 2014, 12:16 PM UTC

chmars wrote: post #106

drdaeman wrote: post #87

Earlier quoted context omitted.

> but you need your own IP Not anymore, unless you need to support antiquities like IE7 on Windows XP or some ancient Java-based software. SNI works just fine in other cases.

OK, good to know – although there are apparently still some restrictions according to comments by other HN users. SSL is still more expensive, though. For most small content websites ( Example: Shared hosting with 4 WordPress blogs, SSL is active but only to access the control panel since the hoster allows SSL only for one domain. Costs incl. a cheap SSL certificate: 110 USD/year. All 4 WordPress blogs with SSL, i.e.…

PositiveSSL Multi-Domain certs allow enterprises and web hosts to secure multiple websites by including up to 100 domains within a single certificate.

$29.88/year.

Re: HTTPS as a ranking signal

#115

Post by ayrx » Thu, Aug 07, 2014, 12:20 PM UTC

ayrx wrote: post #93

spain wrote: post #81

Earlier quoted context omitted.

StartSSL is pretty harmful as evidenced by the events after Heartbleed. The certificates are free but they charge you to revoke them, and after we found out about Heartbleed and realized a lot of those free certs were compromised a lot of people refused to pay up for their free keys and continue using the compromised ones. What's more is that StartSSL refused to do the right thing and revoke them, leading a lot of fo…

Erm... Heartbleed has absolutely nothing to do with what version of OpenSSL you use to generate the cert.

Cheers HN for downvoting a factually correct statement because the parent post got edited after I pointed out an error...

Re: HTTPS as a ranking signal

#116

Post by icebraining » Thu, Aug 07, 2014, 12:21 PM UTC

troels wrote: post #60

Strom wrote: post #47

Earlier quoted context omitted.

I think your description of the situation is rather overblown. Having HTTPS support will only get you a very minor boost in rankings. Additionally, discussing things in a forum usually doesn't get things moving. It's coming out with actual advancements like the original Chrome beta with V8 that drives innovation. I think that the solution to harmful dictatorship should be good alternatives, not more laws to shackle p…

"Having HTTPS support will only get you a very minor boost in rankings." If your livelihood depends on getting traffic from Google - and a lot of sites do - then even a minor boost may equal a lot of money. Plus the fact that you can never know quite how much, so to be safe you must assume it's worthwhile. The problem I have with this move is that to me it appears as Google are furthering their own political agenda.…

Why is "quality content" an objective measure and "user security and privacy" a political agenda?

I agree that it's dangerous for one entity to have so much power over the web, but I don't see how is this particular signal any different from any other they already use, including those which define the quality of the content.

Re: HTTPS as a ranking signal

#117

Post by icebraining » Thu, Aug 07, 2014, 12:26 PM UTC

diafygi wrote: post #108

sorbits wrote: post #23

Would be more awesome if they offered free certificates and an API to renew them. Right now enabling https is not a one-time investment, since a new certificate has to be requested and installed each time the old one expires. Computers are supposed to bring down cost and automate tedious tasks, for https the opposite is the case. It’s worth mentioning that https://www.startssl.com/ does offer free certificates. But w…

What about a kickstarter to subsidize SSL costs? Or how about one to buy a root CA and make it free?

There is already a community-driven CA: http://www.cacert.org/

The problem is that it's not only about money. You need to follow certain procedures or browsers and OSs won't include your root certificate.

Re: HTTPS as a ranking signal

#118

Post by corford » Thu, Aug 07, 2014, 12:28 PM UTC

kmfrk wrote: post #69

corford wrote: post #37

If this change is here to stay they should update their Adsense SSL advice... https://support.google.com/adsense/answer/10528?hl=en-GB

I do not envy the googlers who have to keep stuff like that up to date.

I'm sure their salary more than makes up for it ;)

Re: HTTPS as a ranking signal

#119

Post by richbradshaw » Thu, Aug 07, 2014, 12:29 PM UTC

xyzzy123 wrote: post #68

dsl wrote: post #24

Earlier quoted context omitted.

Take a look at HSTS. It effectively tells clients to try HTTPS first when a user types in your domain. http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

... after the first visit...

Unless your site is on the HSTS list (https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... for Chrome, Firefox use the same list by verifying by connecting via HTTPS and checking for a long HSTS time.)

Re: HTTPS as a ranking signal

#120

Post by madaxe_again » Thu, Aug 07, 2014, 12:34 PM UTC

pierrefar wrote: post #111

madaxe_again wrote: post #104

Earlier quoted context omitted.

Sorry to jump in with a tangential reply, but BEWARE of the following! Google treat the http and https versions of a domain as SEPARATE PROPERTIES. This means that even if you 301 every http page to https when you transition, all of your current rankings and pagerank will be irrelevant. You can verify this behaviour for yourself in webmaster tools. I suppose this is because it's possible to serve up different content…

> Google treat the http and https versions of a domain as SEPARATE PROPERTIES. That's not quite accurate. It's on a per-URL basis, not properties. Webmaster Tools asks you to verify the different _sites_ (HTTP/HTTPS, www/non-www) separately because they can be very different. And yes I've personally seen a few cases - one somewhat strange example bluntly chides their users when they visit the HTTP site and tells them…

Nope, we followed the instructions to the tee. Straight 301 redirects from http to https, appropriate canonicals on all pages referencing https, and their SEO has seemingly started from scratch - used to be in position 1 for a variety of important keywords and searches, now they're beyond page 10.

Oh, and you can't do a change of address from http://www.whatever.com to https://www.whatever.com - you don't allow it!