Confused About Problems Regarding Adding an SSL

[KempRugeLawGroup]

After reading Cyrus' article: http://moz.com/blog/seo-tips-https-ssl, I am now completely confused about what adding SSL could do to our site. Bluehost, our hosting provider, says if we get their SSL, they just add it to our site and it's up in a few hours: no problem whatsoever. If that's true, that'd be fantastic...however, if that's true, there wouldn't need to be like 10 things you're supposed to do (according to Cyrus' article) to ensure your rankings after the switch.

Can someone clarify this for me?

Thanks,

Ruben

[KempRugeLawGroup]

Thanks Cyrus!

[Cyrus-Shepard]

Hi Ruben,

Thanks for writing in. I'm unfamiliar with Bluehost's HTTPs service, but I assume they are taking care of top level issues. You'll still want to go through the checklist to make sure everything is valid and you follow SEO best practices.In short:

• Check your links
• Check your assets (images, CSS, javascript)
• Canonical tags
• Register with Google Webmaster Tools
• Update your sitemaps and robots.txt files

This covers the important stuff. As you noted, a few more tips here: http://moz.com/blog/seo-tips-https-ssl

[max.favilli]

Maybe was obvious to everybody but 301 redirect for every single page is also a fundamental step, otherwise you are going to have broken external links, not to mention WMT which I don't think would be satisfied by just the canonical update.

Sitemap must be updated as well.

We recently switched a website from HTTP to HTTPS and in term of performance there was no difference after the update, at least according to WMT and analytics.

I was kind of scared before to update but at the end everything was smoother than expected, WMT took around 10 days to completely re-index the https version.

But of course we kept finding some non https link embedded here and there in some pages for days and we had to manually edit some content to avoid ssl warning from browsers.

[max.favilli]

I have no idea what CMS you are using but check the server side code generating the link, not just the code sent to the browser.

We recently switched to SSL, and our CMS was already building internal links on pages using the protocol of the http request.

[KempRugeLawGroup]

Thanks Highland!

[KempRugeLawGroup]

Great, thanks!

[AlexMcKee]

Ruben, I had a look at your website and your URLs all have HTTP in them so these would need to be updated all across your site before you make the switch to HTTPS. Because you are using WordPress this should be as simple as updating the site URL to https://www.kempruge.com.

The tip by @Highland about using Firebug is excellent. This will allow you to quickly debug if there are non-HTTPS links remaining - in the WordPress theme or template, for example.

Have a look at the WordPress HTTPS documentation also.

[KempRugeLawGroup]

Hi Alex,

I'm not really sure if we use a protocol-less linking pattern or not. I don't see http:// in any of our urls, so if that's the criteria I'm guessing we don't? I included a screenshot of one of our URLs. Would you mind telling me if it's clear from the image whether we do or do not?

Thanks for your response. I really appreciate your time and input.

Best,

Ruben

DpSaC7H.jpg

[Highland]

One major tip I always point people to is that using protocol-less links for anything external is a great way to make sure your site always supports SSL without issue.

Firebug is a great way to make sure everything is loading HTTPS. Turn it on, switch to the Net tab, and load your page. It will show you every request sent as part of your page. It makes spotting non-SSL requests easy.

You can turn HSTS on yourself if your provider uses Apache and supports htaccess. (sorry I can't link an article, Moz won't let me). If they don't, you will have to have your host enable it on their end.

[AlexMcKee]

Implementing SSL should be straightforward for the most part

You need to ensure that links around your site (including canonical links) are updated to use HTTPS (so https://example.com/link as opposed to http://example.com/link where example.com is your domain name). If you are already using a protocol-less linking pattern (//example.com/link) you don't need to update the links.

You can also configure your web server to only serve HTTPS. If your web server is Apache you can do this with the SSLRequireSSL directive.

 <code><location>SSLRequireSSL</location></code> 

HTTPS also causes a significant slow-down as the browser and the server negotiate a secure connection. If your site has already been optimized for speed it should not cause a problem but if in doubt revisit that process and ensure that you are getting the best possible speed for your visitors.

The article by Cyrus has a great checklist to double check everything.