It’s July 9th and two weeks from today the web is officially going with full HTTPS as requisite, and that’s a development that’s been a long time in the making. Securing traffic on the internet is an obvious priority, but of course there are people who are strongly opposed to having a secure web.
Two weeks today Google will be uniformly labeling any site loaded in Chrome without HTTPS to be not secure. Most webmasters will be on top of this and accordingly usage of HTTPS is exploding right now. In the 6 months up to a recent report, 32% growth in the use of HTTPS was seen in the top 1 million sites. Mozilla tracks anonymous telemetry via Firefox browser and recorded big growth (75% page loads) in the rate of pages being loaded over HTTPS. Chrome too, at around the same 75 percent.
We’re a Canadian web hosting provider who’s always got our thumb on the pulse of the industry, so it’s important to relate that quite a few popular sites on the web still don’t support HTTPS (or fail to redirect insecure requests) and will soon be flagged by Google. Plus, let’s clear up a few emerging myths about HTTPS:
- It’s a Hassle
- I Don’t Need It
- It’s Gonna be Slow
-
It’s A Hassle
No, it’s pretty darn simple. You can protect your site with HTTPS in a matter of seconds for FREE. Sign up for Cloudflare or using a CA such as Let’s Encrypt. We can assist you with any other web security and accessibility concerns you may have beyond https encryption of your website.
-
I Don’t Need It
Well it turns out, you do – particularly as it relates to the safety and privacy of those visiting your site. Without HTTPS, anyone in the path between your visitor’s browser and your site or API can peer in on (or make modifications to) your content without you needing to be made aware of it. Governments, employers, and even especially internet service providers can and have been overseeing content without user consent.
If having your users receiving content unmodified and safe from maliciously injected advertisements or malware is a priority for you, you are advised to move your website to HTTPS.
Add the fact that the major browsers like Apple, Google, Mozilla, and Microsoft, are restricting functionality to only work over HTTPS. Google will soon block unencrypted mobile app connections automatically in their upcoming Android version. Apple has announced that apps must use HTTPS, but there has been no official announcement of this yet.
-
It’s Gonna be Slow
The last common myth about HTTPS is that it’s not speedy enough. This belief is a holdover from an era when SSL/TLS might have had a negative performance impact on a site, but that’s not the way it is today at all or ever. HTTPS is also now required to enable and enjoy the performance benefits of HTTP/2.
Here’s two untruths to consider:
1) It takes incrementally more CPU power to encrypt and decrypt data; and
2) establishing a TLS session involves nothing more than 2 network round trips between the browser and the server.
HTTPS content from the edge – 10-20 milliseconds away from your users in the case of Cloudflare – SSL/TLS enabled sites are superior. And even when they are not served from an edge provider they still function at a high level. Advanced users should also consider using HSTS to instruct the browser to always load your content over HTTPS, saving it a round trip (plus page load time) on following requests.
