HTTPS and SSL in plain words: what it is, why and common mistakes
The padlock in the browser means the connection to the site is encrypted. Without it browsers scare users and search engines trust the site less.
What SSL/TLS is
It is an encryption protocol between the browser and the server. The certificate confirms that the site really belongs to the domain owner. The word SSL stayed in the name for historical reasons, today TLS is what is actually used.
Where to get a certificate
Free certificates (for example from Let's Encrypt) suit most sites and renew automatically. Paid ones are needed for special organisation validation requirements.
The setup you need
- Redirect from http to https with a single 301.
- A certificate for the main domain and, if needed, for www and subdomains.
- Automatic renewal and expiry alerts.
- HSTS configured once everything works, so the browser always uses https.
Common mistakes
- Mixed content: an https page loads images or scripts over http.
- The certificate expired and the browser shows a warning.
- The certificate was issued for another domain.
- Forgetting to update links, canonical and sitemap to https.
Need help with this?
Describe the task and we will suggest where to start. The first conversation is free.