How To’s & TutorialsHow to Add HTTPS to WordPress
The very moment we’ve logged in on a website, or made an online purchase, we’ve shared our personal data with the person running that website. Unfortunately, there is no 100% guarantee that transfer is safe unless the website developer introduced an SSL or HTTPS in order to protect it.
Secure HTTPS is a popular method for encrypting data, known to secure and streamline users’ browsers to server connections. Thanks to it, hackers have a hard time eavesdropping content, and usually give up on it. SSLs, on the other hand, are unique identification certificates issued for every website, thanks to which fake HTTPS are easily detected, and the user is warned not to share their information there.
SSL – what is it?
SSL (Secure Socket Layers) were initially simple securing methods, introduced by Netscape Communications in 1994. They became popular in less than no time, which is why they were revised in 1996, and a new 3.0 version was introduced for reinforced security. However, the tools were still experiencing vulnerabilities and were therefore considered for improvement in 1999, this time by Internet Engineering Task Force (IETF). The company started by renaming them to TLS (Transport Layer Security), which is why the tool is often met as TLS/SSL. Nowadays, it is one of the most meaningful website security standards.
Why should you consider SSL and HTTPS?
E-Commerce website owners should definitely obtain an SSL certificate, knowing how sensitive the payment information they’re collecting can be. This is why PayPal, Stripe, Authorize.net and similar payment service providers require stable and secure SSL connections in order to be used.
In fact, Google started ranking websites depending on whether they’re HTTPS and SSL qualified, which means that these security methods have a lot to do with your SEO. It may take some time for the engine to rate you higher on the list, but prepare to wait until the switching is completed (meanwhile, there will probably be only 1% increase).
At the same time, websites that require personal data input, as for instance names, addresses, or payment details, must be SSL covered. Otherwise, there will be a big chance for your user’s information to be compromised.
What will SSL do for you?
SSL’s main function is to encrypt data passing from the server to the browser, which means you won’t be able to see it in a plain-text format. More likely, it will display in an apparently accidental string of non-readable numbers, letters, or even words.
In order to make your SSL connection even more secure, research reputable companies tagged as Certificate Authorities, and purchase the best offer you can afford. Once the process is complete, all details are given to the certifying company to protect them, and you’re completely free from any data breach related responsibility.
As the website’s owner, you will also have to share your corporate/personal details, and you will receive both a private and a public key should keep to yourself. These keys play the role of a unique password that must remain private but takes less effort to cover.
The key consists of another string of encrypted numbers and letters, which nevertheless fit in perfect mathematical order. The reason is that this key is used to unlock information, and designed with a special Secure Hash Algorithm to connect it to previously inserted information stored in your Certificate Signing Request file.
All information is examined and verified by the authority in order to prove you’re not a hacker or a scammer. If all pieces fit together, you get your SHA-signed SSL certificate.
It is only once the certificate is issued that you get to benefit from the SSL-enabled connection.
What happens next? The visitor arrives on your protected website, and the server matches your private key with their SSL certificate. If everything is in order, an encrypted link is being established between the browser and the website, and the user gets to perform the desired action.
WordPress requirements for using HTTPS and SSL
WordPress is world’s leading content creation platform, which makes it a frequent and desirable target for hackers. This is why developers took special care of security concerns and put a high SSL threshold for certificate holders. Even those who’ve already purchased a certificate have to consult their hosting providers and make sure the key is properly installed on the server.
WordPress Setup needed for SSL and HTTPS
The most common HTTPS scenario is when you’re starting a new website, and wish to apply HTTPS on each and every page. In this case, the first thing to do is to update the URL.
Note that every change you’re about to perform has to be done on a backed up website so that you will save your data whatever happens. Once done, you can move on adding your SSL data to the website, and adjust your WordPress settings for the website to redirect from HTTP to HTTPS.
Installing SSL on one or multiple sites is very simple – you need to open your wp-config.php file and insert the below-mentioned code. Doing this will make sure that both the WordPress admin area and the logins are using SSL and operating in safe mode.
define('FORCE_SSL_ADMIN', true);
The code line should be placed just above the ‘Stop editing’ line. The next thing required from you is to set up 301 redirections to enable every visitor that lands on the website see the protected and secured version of it. This is the moment where http becomes https.
In order to enable 301 redirections, open the .htaccess file, and place the code we are about to mention there. In case you don’t have such a file, create one with the same name.
RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule^(.*)$ https://www.mysite.com/$1 [R,L]
Remember to change ‘mysite.com’ with the name of your domain, and switch server ports to 80. Reload the website yourself to see whether the https appears in the URL. It should be displayed with a green padlock next to it, as it indicates the website can be used securely.
Distinguishing SSL-protected websites from unprotected ones
The first change you will notice is a modified prefix at the beginning of your browser’s address field – http becomes https, and a small green padlock appears next to it in the URL.
Instead of the regular SSL certificate, you can choose to buy an Extended Validation version, which makes the entire address bar green, and includes the company’s name equally colored in front of the URL.
However, the purpose of purchasing an Extended Validation Certificate is not simply aesthetical – these security allowances are more powerful than the regular ones, and involve a longer and more cumbersome application process. If you want one, you would have to confirm that your physical address is genuine and that your operations meet all legal standards required in your industry.
How does an SSL certificate look? On it, you can see the company’s name, domain name, address, and city, state, and country if applicable. The certification details and responsible issuance authorities are also mentioned the same as the key expiration day.
Whenever a user is connected to your website, his browser retrieves your SSL certificate and confirms it is properly validated and unexpired. The next thing being checked is the authority that issued it, and the purpose why that authority released it. The SSL check has to pass all of the criteria successfully, or warn end-users in case even one of them is not complying. After that, it will be the user’s choice whether he wants to check your website or not.
The importance of HTTPS
As you saw for yourself, SSL certificates are essential when providing the appropriate security level for your visitors, but there are many more precaution tactics you should check out. WordPress gives you the chance to protect your visitors in a variety of other ways and offers plugins that can help you do so. The most popular ones at the moment are iThemes and Wordfence.
HTTPS, on the other hand, is compulsory because it encrypts information while it is being transferred from the server to the client. So far, there hasn’t been a better method to ensure data won’t be intercepted or misused, which is why the most prominent payment login systems make use of it.
Using SSL may be a bit of a challenge in the beginning, but the platform can help you sort concerns out by checking out its pointers mentioned in the WordPress Codex, more specifically the Administration Over SSL page. You will be surprised by the variety of specific, individual-grade options that are available there.
At the same time, there are plugins specifically developed to help you grab hands around SSL, but you should check whether you’re working with their latest and most compatible versions.
Once again – SSL installation doesn’t eliminate other security steps you should consider for protecting WordPress data. Passwords, for instance, can be both the strongest and the weakest asset you have, and a common users’ mistake you have to back up with the appropriate security precautions.
If possible, purchase an SSL certificate for an HTTPS connection, install the right plugins and keep them up-to-date, scan for threats and malware, encourage users to think of a stronger password, and lock all suspicious accounts to prevent botnet attacks on the website. SSL certificates won’t cover for any of the measures mentioned about, and won’t prevent a malicious script from extracting system data unless you’ve closed all ports for the attacker to do so.
You may also like:
The Fundamentals of Frontend Development: Getting Started & Beginner’s Tips
How to find blogging inspiration
20 Simple Tricks to Boost Your Website’s Traffic
