What is SSL/TLS?
They are the evolving encryption tools that are the difference between a web page (via HTTP) that can be clearly Intercepted and ALTERED, and a page (via HTTPS) that is both encrypted with a chain of trust that makes it extremely difficult to view and even more difficult to alter in any way. If you want to know more, you can read more here.
To answer the questions of:
- Why are some browsers making so much noise about why your unSSLized site is so untrustworthy?
- Why your unsecured site is so low on the search engines?
Reason #1, the big one.
If your website doesn't have a proper TLS/SSL encryption in place, then if someone can intercept a person's browsing, it is easy to inject whatever hostile code is desired. It could be to just change what is showing on the page (this site hacked!), to silently injecting the latest ransomware or worse.
You want your readers to get the message you so carefully crafted, not something else. You don't want them to equate you with putting malware on their system.
Reason #2
There is a pile of constant malicious scanning going on all the time, and just forcing your site to HTTPS causes a good portion of it hitting your site, to just go away. One of my sites was getting many dozens a month of links from very dubious sites before I forced a switch to SSL, then they just went away.
There is then the whole Cyberwar part it of, where you could be caught in the middle of the big boys playing, as what was clearly happening as a part of a real hot war with the Russian Invasion of Ukraine as written up at the Internet Storm Center where an entire block of IP addresses are redirected to another set of servers away from Twitter for a portion of the world. Just too many ways for Man-In-The-Middle attacks.
So assuming you:
- Don't want your readers scared away by the browser warnings
- Don't want your readers to get used to a bad security practice because you taught them to
- Don't want your readers' devices to become part of a hostile bot-net and/or worse.
- Would like (love?) your content to be more readily found by having a higher position in the search engines.
To get there
This is done on the web-server itself, where you either pay for a certificate or use a free certificate service such as Let's Encrypt. First you want to make sure your site works with the certificate so that you can get that lock in front of your URL (aka address) in the browser, and then you want to set it so that all attempts to come in unencrypted (port 80) get flipped/redirected to encrypted (port 443)
If you built your server, it is time to go RTFM for this as it is well documented for all Web-servers, as well as many others have written about the process. Your favourite search engine can also point you to resources.
If you are using a more typical hosted service, there is a very good chance the ability is sitting there in your control panel, just waiting to be turned on. Automatic free encryption has been a part of CPanel for a couple of years now (my hosters turned it on automatically for me), and a quick search shows that many of the others have a similar feature. So take a look at your control panel, use the knowledge base most hosters setup, or even contact your support to see how good they are.
There will be attempts to up-sell you to a higher grade of certificate. If you just have a basic, low volume static site, then there is no real value in the "enhanced protections". If you are gathering anything beyond comments and email addresses, such as e-commerce orders, then an actual purchased certificate makes some sense. If you do go with a purchased certificate, make sure your hoster manages it and the update/renewal process, that they should have, is automated as certificates only last a year or less.
Do you require any assistance in securing your systems? Perhaps we can help.
No comments:
Post a Comment