Securing your website with HTTPS

My name is Amy Kvistad, and I’m going to talk about HTTP and HTTPS migration — why it matters, and how you can do it.

My website is amykvistad.com. You can follow me on Twitter at @amykvistad, and the slides are already posted there if you’d like to follow along.

I’ve been a member of the Boston WordPress meetup group since 2009 and attended the first Boston WordCamp that same year. I’m now a co-organizer. I’ve been doing WordPress design and development since 2009, and graphic design for 16 years. On a personal note, I’m co-parenting a new puppy, and when the weather is nice, I like to go sailing.

We’re going to cover what HTTPS is, why it’s important, common myths, and how to migrate your website.

HTTPS is a secure layer on top of regular HTTP. It adds encryption so communication between your website and the server is secure. It provides authentication — your SSL certificate proves you are the site owner. It prevents man-in-the-middle attacks, as well as cookie and password exposure. But vulnerabilities remain: your site can still be hacked, servers can be compromised, and software needs to be kept up to date. That’s why it’s critical to keep WordPress, plugins, and themes updated, and protect against brute-force attacks.

So why migrate? Because HTTPS is the new baseline for the web. Standards bodies, browsers, and tech companies all say HTTPS should be the default. In 2014, the Internet Engineering Task Force declared pervasive monitoring an “attack.” The White House issued an HTTPS-only standard for government sites. The W3C set three goals in 2015: prefer secure communication, remove barriers to adoption, and don’t compromise TLS. Mozilla announced they would phase out non-secure HTTP. Google said that as of January 2017, pages collecting passwords or credit cards over HTTP would be marked “Not Secure,” with stronger warnings to follow. WordPress also announced that new features would require HTTPS support. As Google Chrome’s Emily Schechter put it: “HTTPS is one of the most important topics for web developers today.”

There are a few myths worth clearing up. First, that HTTPS is expensive. Not anymore — services like Let’s Encrypt make it free. Second, that it’s hard to set up. Many hosts now automate the process. Third, that it makes sites slower. In fact, HTTPS enables HTTP/2, which can make sites 50–70% faster. And finally, that it hurts SEO. The opposite is true: HTTPS preserves referral data and gives a ranking boost on Google.

So how do you migrate? Start by getting an SSL certificate. Many hosts now offer Let’s Encrypt free. Traditional SSL certificates cost more and usually include a warranty, which may be needed for e-commerce or sensitive data. Next, update your WordPress settings: change the site and home URL under Settings → General to HTTPS, or update in phpMyAdmin. Force HTTPS throughout your site with a plugin such as Really Simple SSL, or add rules to your .htaccess file. Force HTTPS for admin and login pages via wp-config.php.

Fix mixed content by using the Better Search Replace plugin to update old HTTP URLs in your database. Use tools like Why No Padlock or Chrome Inspector to identify insecure elements. Be sure to secure assets like Google Fonts, logos, or plugin resources that may be hardcoded with HTTP. Update your supporting services: add your HTTPS property in Google Search Console, resubmit your sitemap, update Google Analytics, and make sure your CDN supports HTTPS and HTTP/2.

For example, I worked with a client who needed secure forms for parents to submit payments through Authorize.net. The site initially had issues: Google Fonts were being requested over HTTP by a plugin, and the logo was still pointing to the development server. Once those were fixed, the site showed the green lock — a secure connection.

There were also questions. Wildcard certificates? Let’s Encrypt doesn’t yet support them, so if you need subdomain coverage, use a traditional SSL certificate. SiteGround specifics? Renewal may differ by host, so check auto-renew is enabled. Expensive healthcare-level certificates? Higher-cost SSL certificates usually include a bigger warranty or Extended Validation, but for most sites, Let’s Encrypt or a standard certificate is enough.

To summarize: SSL certificates are now free and widely available. HTTPS is the new internet standard. It’s easy to set up. It makes your site faster. It helps SEO and preserves referral data. So, migrate to HTTPS now.