It still happens: online stores running without an SSL (TLS) certificate. Why would you store customer data insecurely or send it across the internet unprotected? In this post, I’ll briefly cover where things stand, the benefits, and the work involved. One thing you can count on: secure connections are becoming more trusted and more standard for visitors, store owners, and search engines alike.
Where do things stand today?
We’re moving steadily toward a more secure internet. User details, sign-up forms, passwords, orders: you want all of this data sent securely. Consumers now see that as the standard, and they expect it. In 2014, Google made SSL certificates a ranking factor. Google started checking whether a website used a secure connection, and that affected your position in its search results. This has only grown more important since. Google has just announced that its Chrome browser will take this into account too. Chrome will show a warning whenever a website that sends personal data uses an HTTP connection, and starting in January, that warning will appear quite prominently in the address bar. Your Google Shopping account also requires an SSL certificate for your store. In short, Google is pushing both consumers and store owners toward secure connections.
Run your entire site over SSL
A domain with SSL is seen as stronger than one without. We always recommend securing your entire site. Store owners used to worry that some modules (image uploads, for example) would stop working. The concern that SSL makes a store much slower is also largely outdated. When everything runs over a single connection, you avoid cross-domain errors and your site runs more securely.
Visitor trust
For visitors, the ideal is an SSL certificate with the green address bar across your entire online store. Securing only the checkout causes hardly any problems, but the best solution is still the green bar showing your company details. SSL also matters for quality marks such as Thuiswinkel Waarborg, which requires your store to send customer data securely over an HTTPS connection.
Conclusion
Having weighed all of this, we can think of very few good reasons not to run your online store over SSL. Looking ahead, a secure approach is simply the better choice.
Types of SSL certificates
Which certificate do you need? Do you want SSL for all your domains (.at, .de, etc.) or just for yourdomain.nl? Keep in mind that an SSL certificate treats www.yourdomain.nl and yourdomain.nl as separate domains.
Here are the options:
- A basic single-domain certificate: Comodo Positive SSL – €9 per year
- A basic multi-domain certificate: Comodo Positive SSL – €30 per year (8 domains)
- An EV single-domain certificate: Comodo EV SSL – €125 per year
- An EV multi-domain certificate: Comodo EV SSL – €225 per year (includes 2 domains, €50 per additional domain)
What the work roughly involves:
- Purchase a certificate (for one or more domains)
- Install the certificate on the server
- Configure Magento (and any modules) so everything runs over HTTPS
- Test the store and modules for errors (such as old hard-coded URLs on a content page)
- Update your sitemap and have Google re-index your site
- Set up 301 redirects in your .htaccess file so every page points to its HTTPS version
