Is switching to https worth it?

[xelaetaks]

For an ecomemrce site is it worth the switch? Will backlinks lose weight after switching?

I've seen a few reports of ranking drops in the past but also some saying that it is temporary. Anyone have experience with it and thoughts on if it is worth doing?

Thanks

[bumpski]

Regarding performance (and maybe ranking?)
If you have a fast loading site already, I've found using webpagetest, and other metrics, that one site I measured took a 50% hit in pageload time using https.
Testing Google's home page itself I see a 30% hit in load time.
By the way, if you want somewhat faster searches you can use http:// www.google.com/?nord=1 and Google will stay in non-secure mode, however even in this mode Google has a hard coded secure link to https:// apis.google.com, so even with this trick Google is not as fast as it used to be.
NOTE: I've put spaces in these links so WW won't promote them and make them true links.

Google has benefited enormously by switching to https for searches. Nobody, including all the intermediary sites in the path to Google, can intercept keywords embedded in the search request.
Unfortunately they are really slowing the web down by needlessly increasing (in most cases) web overhead. I really don't care when I search for the price of iron pipe whether all the intermediaries in the "trace route" to Google can see what I'm looking for. But what I am tired of is waiting 20 seconds on my DSL line for the answer!

Also when looking into secure certificates some of the "free" SSL certs had some kind of backdoor penalty (cost) when attempting to decommission a domain. I don't understand it, or remember the details, just remember being surprised by the reports.

[wheel]

I believe that the speed penalty with SSL isn't practically in the transmission - pretty much the same amount of data. The speed hit is in the encryption and the decryption, by the user's PC and the server. And those really not much of a speed hit.

If you're seeing noticeable speed decreases, likely there's something else going on.

[bumpski]

If you're at all concerned about performance, switching to HTTPS, (I'll use SSL from now on), is a mistake. Perhaps, sometime in the future things will be better, but, that's the future! Supporting both http and https might be an alternative.

I've provided links using WebPageTest.org to analyze google.com's performance using SSL, and as best as can be done without SSL. There is a big difference. If you have a site whose pages take 15 to 20 seconds to load, maybe you won't notice the overhead, but if your domain structure is not implemented correctly, you will take a big hit. Google's philosophy in the past was to use multiple subdomains and even domains to allow older browsers to load pages faster, with the additional overhead this causes with SSL, and modern browsers, this idea should be reconsidered. Also wildcard SSL certs must be acquired, and if you use sub, sub domains, wow!

WebPageTest provides a "Bytes In" which appears to show the entire size of the messages involved in rendering a web page. Most browser's "Network" analysis tools show message size after decryption, and most show size before and after gzip/deflate compression. I will say that Google's home page has become enormous, 518K, in 2007 it was more like 5K bytes, perhaps this is due to their mobile implementation? So the enormity of Google's home page does mask the SSL overhead to some extent.

The links below are navigable. Look to "SSL negotiation" violet bands.

The first link, https: //www.google.com encrypted
[webpagetest.org...]

The second link, a comparison between the above and the link http ://www.google.com/?nord=1
For this comparison use the Opacity Slider provided to compare the differences.
[webpagetest.org...]
Please note that the un-ecrypted test still suffers the penalty of an encrypted transaction to apis.google.com. Google's home page would have loaded in 1.8 seconds without SSL (HTTPS) With SSL Google's home page loads in 2.9 seconds.
Of course Google benefits tremendously from web and browser caching which hides some of these inefficiencies.

The third link, to be complete, is the results with as little encryption as possible, similar to the results used in the comparison above.
[webpagetest.org...]
This shows a result that would have completed in 1.4 seconds without any encryption.

The most rudimentary test:
Two links http versus https from google for a png file of size 21.4K, The Google logos.
[webpagetest.org...] HTTPS
Notice "Bytes In" at 30K, but in the Request Details 21.6K
[webpagetest.org...] HTTP
Notice "Bytes In" at 22K, but in the Request Details the size remains 21.6K

The final test link:
[webpagetest.org...]
Shows what happens to users who type the shortest link possible to google, google.com
A 301 redirect to www.google.com, and then a 302 redirect to https:// www.google.com. I must admit I was surprised by that one!

Finally to explain this excess "Byte In" count I have a link to an article by Ilya Grigorik web performance engineer at Google. The link is courtesy of Patrick Meenan of WebPageTest.org
Optimizing TLS Record Size & Buffering Latency
[igvita.com...]

In evaluating my sites for https, I see the same kind of very significant overheads using current SSL/HTTPS.

[Selen]

We could learn from the biggest online ecommerce website.. www.amazon.com [amazon.com] - guess, without clicking, if it has SSL by default or not :)

[samwest]

Didn't do a thing for my site, but then again I wasn't trying to gain anything. Been using https for quite some time.

[Jack_Hughes]

One observation I had when switching to HTTPS is that Google webmaster tools didn't handle the change very well. It no longer tracks the domain properly at all, information about the back links and keyword data are both gone.

[samwest]

Hasn't made any difference, but we weren't looking for it to do so...just to provide more security because our visitors join and login with their personal data.

[robzilla]

One observation I had when switching to HTTPS is that Google webmaster tools didn't handle the change very well. It no longer tracks the domain properly at all, information about the back links and keyword data are both gone.

You may need to add the HTTPS site as a new property.