# No HTTPS yet - may want to reconsider **URL:** \ **Category:** RapidWeaver Classic\ **Created:** [May 3, 2017, 9:24pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889 "2017-05-03T21:24:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![teefers](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/teefers/32/8173_2.png) [@teefers](https://forums.realmacsoftware.com/u/teefers)\ **Post date:** [May 3, 2017, 9:24pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/1 "2017-05-03T21:24:06Z")
If you’ve been putting off switching your site(s) to HTTPS, you might want to consider planning the move. Google’s Chrome the most used browser now marks any HTTP page as Not secure, if it has password or credit card fields. Starting in October Chrome will add the “not secure” warning to all HTTP pages when a user enters any data (i.e., contact form, email sign-up and search boxes). In this phase, it is just a warning, but I would imagine that your conversion rate will drop. > **[Next steps toward more connection security](https://blog.chromium.org/2017/04/next-steps-toward-more-connection.html)** > > In January, we began our quest to improve how Chrome communicates the connection security of HTTP pages. Chrome now marks HTTP pages as “No... Also, you get a bump in your page ranking from search engines. The main reason to make the jump to HTTPS is your customer’s privacy. Lots of snooping going on from public WIFI, ISP’s, etc. Here’s an interesting post from Chris Coyier from CSS-tricks. > **[Just Another HTTPS Nudge | CSS-Tricks](https://css-tricks.com/just-another-https-nudge/)** > > I was strongly reminded about the scariness of non-secure websites the other day. I'm using Xfinity as an internet service provider, and they give you a ---
**Author:** ![Rovertek](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/rovertek/32/223_2.png) [@Rovertek](https://forums.realmacsoftware.com/u/Rovertek)\ **Post date:** [May 3, 2017, 10:03pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/2 "2017-05-03T22:03:01Z")
Yep, it’s time to make a move to more secure web development, folks. But remember that getting a SSL/TLS certificate is just the first step. It makes things more secure on the developer’s side rather than on the viewer’s side. To make things more secure for visitors of your website, you got to implement some more security measures – you should do it by placing some directives in your **.htaccess** file, especially if you are on a shared hosting plan. After I got my [Let’s Encrypt](https://letsencrypt.org) free SSL/TLS certificate, my security rating was still “ **F** ” (according to the [Observatory](https://observatory.mozilla.org) rating site). After I implemented additional security measures recommended by the Observatory, my rating jumped to “ **A+** ”, but that broke some functionality of my site. So, I had to go back and withdraw some security directives. That made my site fully-functional again, but my rating dropped to “ **B** ”. Now, I have to rework some features of the site to get even better rating. BTW, paying for the certificate won’t make it any more secure than getting the free one from “Let’s Encrypt”. ---
**Author:** ![DaveFox](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/davefox/32/129_2.png) [@DaveFox](https://forums.realmacsoftware.com/u/DaveFox)\ **Post date:** [May 4, 2017, 4:44am UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/3 "2017-05-04T04:44:38Z")
FWIW, I run 9 sites for different people / organisations, 2 were with a host who wanted £45 per year to implement HTTPS, the other 7 were with [one.com](http://one.com) who offer a one click conversion (via CP) to https with Comodo for free (ATM) - it was a no brainer to move the 2 sites to [one.com](http://one.com). ---
**Author:** ![mike\_s](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/mike_s/32/7366_2.png) [@mike\_s](https://forums.realmacsoftware.com/u/mike_s)\ **Post date:** [May 4, 2017, 12:11pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/4 "2017-05-04T12:11:49Z")
I’ll just add that even paying for certs is no guarantee they will be honored by browsers in the future. Here Google found that certificates from Symantec were allegedly mis-issued and are beginning the process of un-trusting them over time. So while the move to HTTPS is crucial for websites, it is also one that requires diligence from designers and owners alike. > **[Google takes Symantec to the woodshed for mis-issuing 30,000 HTTPS certs...](https://arstechnica.com/information-technology/2017/03/google-takes-symantec-to-the-woodshed-for-mis-issuing-30000-https-certs/)** > > Chrome to immediately stop recognizing EV status and gradually nullify all certs. ---
**Author:** ![Fuellemann](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/fuellemann/32/22871_2.png) [@Fuellemann](https://forums.realmacsoftware.com/u/Fuellemann)\ **Post date:** [May 4, 2017, 12:20pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/5 "2017-05-04T12:20:44Z")
Hi Rob, could you elaborate on what you did in detail and which recommendations you followed? The site is not so easy to understand… ---
**Author:** ![Rovertek](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/rovertek/32/223_2.png) [@Rovertek](https://forums.realmacsoftware.com/u/Rovertek)\ **Post date:** [May 4, 2017, 1:32pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/6 "2017-05-04T13:32:48Z")
Hey, Jan, Basically, what I did is shown in the screenshot. There is eleven test results. Two of them are failed (I had to fail the CSP policy on purpose, because it was breaking my site). The other 9 directives are in my .htaccess file. ![](https://europe1.discourse-cdn.com/flex005/uploads/realmacsoftware1/original/2X/2/214a4477fd38c41601dd0a3a13a1f81c3b363c9b.png) To successfully implement those security rules you will have to spend some time for a research on Internet, but all information is relatively easy to obtain. I had a great help from people running the [forum](https://community.letsencrypt.org) on **Let’s Encrypt** website. Other great sources of info: **Web hosting supporting Let’s Encrypt** – [Web Hosting who support Let's Encrypt - Issuance Tech - Let's Encrypt Community Support](https://community.letsencrypt.org/t/web-hosting-who-support-lets-encrypt/6920) **Let’s Encrypt Documentation** – [Documentation - Let's Encrypt](https://letsencrypt.org/docs/) **Security Guidelines** – [Web Security](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy) **Security Headers** – [https://securityheaders.io/](https://securityheaders.io/) **Content Security Policy** – [Content Security Policy - An Introduction](https://scotthelme.co.uk/content-security-policy-an-introduction/) **Certificate Authority Authorization** – [Certificate Authority Authorization](https://scotthelme.co.uk/certificate-authority-authorization/) ---
**Author:** ![Fuellemann](https://dub1.discourse-cdn.com/flex005/user_avatar/forums.realmacsoftware.com/fuellemann/32/22871_2.png) [@Fuellemann](https://forums.realmacsoftware.com/u/Fuellemann)\ **Post date:** [May 4, 2017, 5:04pm UTC](https://forums.realmacsoftware.com/t/no-https-yet-may-want-to-reconsider/13889/7 "2017-05-04T17:04:44Z")
Thank you very, very much !