Infographic: 10 HTTPS implementation errors to avoid!

Since January 2017 the will of Google, to see all websites migrate to the HTTPS protocol, results in the reporting, via the browser Chrome, unsecured sites. All sites that use unsecured resources (files, protocols ...) are reported as unsafe to users.

However, at last count only 45% of websites have migrated to the HTTPS protocol currently. Which means that internet traffic is far from completely secure? It must be said that the implementation is quite heavy and can lead to errors on the site. Nevertheless, this passage is necessary to guarantee your audience over time. It has been clearly announced that Google will privilege HTTPS sites in the SERP.

The non-security of passwords

The HTTPS protocol must be installed on pages that require the entry of a password. This is the only way to ensure the security of information and to avoid being stolen data. However, SEMrush points out that 9% of the pages that require the entry of a password are not secure.

Errors related to mixed content

The concept of mixed content applies to web pages composed of several different elements: links, scripts, images ... not secured by the HTTPS protocol. When opening a document, watching a video or downloading a file, a message warning the user that the content is not secure may appear. Which is particularly harmful for the rest of the conversion process ... However, 50% of the sites analyzed presented this error.

Problems arising from the internal mesh

When you switch from HTTP or HTTPS, pay attention to the internal mesh! Internal links must point to secure links. If this is not the case, the user may encounter a message informing him that the connection is no longer secure. Which is harmful for your bounce rate and the trust given by your prospect?

The security certificate and associated HTTPS errors

To obtain a secure connection between a browser and a server, it is essential to use a Secure Socket Layer (SSL) certificate. It also protects the data on a site.

The study conducted by SEMrush found that 2% sites had an SLL certificate whose expiry date had expired. In addition, 6% of sites had an SSL certificate for which the registered domain name was incorrect.

On this last point, you should know that a certificate issued on a domain name does not work automatically on the sub domains. When choosing a certificate, make sure it is multi domain and indicate all the addresses that lead to your website. This avoids error messages during the course of your prospects.

Server problems

The SEMrush study looked at the number of websites that do not have HTTP Strict Transport Security (HTST) support: only 14% of sites support HSTS. This protocol is added to the HTTPS to block the downgrade attacks (lowering the version of your CMS) and cookie hijacking (data recovery of a user's session). Nevertheless, this technology has just arrived on the market, which explains its low utilization rate.

In addition, the analysis of SEMrush has highlighted the fact that 3.6% of websites are displayed with a version of the security protocol not updated. However, it is essential to always have the latest version, to guard against attacks and data theft. Hackers regularly find new loopholes, which servers correct via patches and new versions. If you forget to install them, you expose yourself to the risk of hacking.

The transition from an HTTP site to HTTPS is essential for SEO of your website. In addition, a secure site gives immediate confidence to your prospects. They will more easily take the time to navigate, fill out your forms and thus convert. Conversely, the slightest doubt or message about the non-security of your website, they will flee quickly ... without necessarily returning.

As highlighted in this infographic, this complex migration can be a source of many errors that are harmful to your SEO. In order to avoid this, we can accompany you in this project; do not hesitate to contact you to determine how we can collaborate together.