4. “Individually, the meta data you can gather from
unencrypted sites can seem benign, when you put
it all together it uncovers a lot about my intent and
can actually compromise privacy.” Ilya Grigorik
6. Maile Ohye SMX Advanced 2015
HTTPS benefits:
• Authenticates the site
• Grants data integrity for the client
• Gives encryption which is good for the user
“For new and particularly powerful web platform
features, browser vendors prefer to make the
feature available only to secure origins by default.”
Sounds
interesting!!!!
7. August 2014
“Making the
internet safer more
broadly”
“Over time, we
may decide to
strengthen it.”
“It’s only a very
lightweight signal”
10. Growing trend
towards HTTPS
5%
6%
7%
8%
9%
10%
Jan March April May June July August
% Alexa Top 100K Websites on HTTPS (2015), DeepCrawl
0%
20%
40%
60%
80%
100%
Jan March April May June July August
% Alexa Top 100K Websites HTTPS/HTTP, DeepCrawl
HTTPS HTTP
Opportunity
18. • Speed - HTTPS runs slower than HTTP
• All resources (JS, CSS, images) need to be on HTTPS.
• Internal links, Sitemaps, canonical tags, robots.txt file and analytics
tracking codes need to be updated to refer to HTTPS version.
• 302 redirects not a clear enough signal that the site has moved to
HTTPS. Google specifically state that 301 redirects should be used.
• Avoid redirect chains – avoid latency
• HSTS not enabled in addition to HTTPS
• Might incur issues with third-party resources (e.g. ad networks)
• Analytics and backlink data could be affected.
• Social shares also need to be migrated/managed to retain social proof
(only Facebook, Google +1 and LinkedIn shares transfer automatically,
although this can still take weeks/months).
22. When should you migrate?
New Websites: Definitely build on HTTPS
Existing Websites: Migrate to HTTPS when you’re
next planning a domain migration
Or,
Build the infrastructure to support
HTTPS during a site
redevelopment for a later URL
migration
32. What is HTTP/2?
HTTP/2 (originally named HTTP/2.0) is the second major
version of the HTTP network protocol used by the World
Wide Web. It is based on SPDY.
HTTP 1 was designed for webpages with few external
assets. Browsers typically downloaded assets
sequentially, but this wasn’t a problem on lighter pages.
Now most webpages have 50+ resources, which is
difficult for HTTP 1 to handle.
HTTP/2 downloads many resources at the same time,
prioritizes them and supports compressed HTTP headers.
https://http2.github.io/
33. The proposed changes do not require any changes to how existing
web applications work, but new applications can take advantage of
new features for increased speed.
HTTP/2 allows the server to "push" content, that is, to respond with
data for more queries than the client requested.
HTTP/2 enables a more efficient use of network resources and a
reduced perception of latency by introducing header field
compression and allowing multiple concurrent exchanges on the
same connection. It also introduces unsolicited push of
representations from servers to clients.
This specification is an alternative to, but does not obsolete, the
HTTP/1.1 message syntax. HTTP's existing semantics remain
unchanged.
Googlebot did not (as of June 2nd 2015) support HTTP/2
https://http2.github.io/
38. HTTP/2 and HTTPS
“Although the standard itself does not require
usage of encryption, most client implementations
(Firefox, Chrome) have stated that they will only
support HTTP/2 over TLS, which makes
encryption de facto mandatory.”
https://en.wikipedia.org/wiki/HTTP/2
This talk is going to focus on HTTPS, the challenges people are facing when migrating and why you should be planning your migration.
Web Search & Chrome Team
Security benefits are clear – public WIFI is inherently risky
August 2014 – Lightweight Signal but May Strengthen
Common sense approach – to allow webmasters time to migrate
Common sense approach – to allow webmasters time to migrate
Other benefit as highlighted by Moz confirms when traffic passes to an HTTPS site, the secure referral information is preserved rather than stripped away and shown up as “direct” https://moz.com/blog/seo-tips-https-ssl
I’m afraid I’m not going to sensationalise this issue – as tempting as it has been for several commentators. We’re going to take a look at what Google actually had to say, where people are struggling at present, and some pointers to help you make this as painless as possible.
Built with indicates a figure around 6% - slightly different methodology to DeepCrawl but safe to assume somewhere between 6%-9%: http://trends.builtwith.com/ssl/SSL-by-Default
As with any site migration, prepare for a drop in rankings/traffic in the short-term -
Did they forget to move their disavow file when they migrated? I can only conclude that a penalty of this magnitude must have been a Penguin related incident.
When you’ve got your disavow file uploaded and you are moving to a new domain, your disavow file is not automatically moved to HTTPS. Therefore, if you don’t upload your disavow file to the HTTPS version of Google Webmaster Tools, it is not taken into consideration and you risk being hit with a Manual Penalty or by Google Penguin.
Here’s a quick selection of issues. It is technically demanding - lots of moving parts.
I’m not sure this was even possible last August.
It's also just a lot of work, and very the best you can hope for is to see no change.
Let’s return to the story, where are we now?
Guilting people into a change 12 months on from a controlled announcement.
You have to take into account that the ad-networks can’t serve everything completely.
HTTP 1 is showing it’s age. Many of us spent countless hours attempting to optimising images and so forth. This will represent a step change – fit for purpose.
SPDY was designed by Google – approved by Facebook
SPDY was designed by Google – approved by Facebook
Has now been passed as an RFC.
Enable HTTP/2 – making the page load times much better but not just for the user but also on the server. Fewer handshakes, fewer sockets, fewer buffers = less memory and workload – decreasing ops costs
HTTP/2 is supported by the most current releases of Firefox and Chrome.