Forum Moderators: phranque
Nonsecure Collection of Passwords will trigger warnings in Chrome 56 for www.example.com
Beginning in January 2017, Chrome (version 56 and later) will mark pages that collect passwords or credit card details as “Not Secure” unless the pages are served over HTTPS.
The following URLs include input fields for passwords or credit card details that will trigger the new Chrome warning. Review these examples to see where these warnings will appear, and so you can take action to help protect users’ data. The list is not exhaustive.
....
The new warning is the first stage of a long-term plan to mark all pages served over the non-encrypted HTTP protocol as “Not Secure”.
Anythoughts on how to improve any of this?
1. Buy a security certificate for every domain ($15 x 71 = $1065 /year);Why, when there exist free certificates, and you only require a minimal level of security?
2. Modify every site to run every page through that security certificate;Huh?
4. Change the htaccess to redirect non-secure pages to secure, so that external links continue to work.This "change" involves adding a single RewriteCond to the already existing domain-name redirect. That's all. Any existing redirects whose target currently contains http:// can be changed to https:// with an unsupervised global replace. An unsupervised multi-file global replace, in fact.
and I'll lose some search engine placement.Either Google wants sites to be https, or it doesn't.
And BTW - HTTPS sites do not run slower. In fact, they will be much faster as HTTP/2 becomes standard.
Also there's no proof you will "loose search engine placement" and every indication you will gain advantage in SERP as Google has explicitly said so.
mobile CPM has been a tiny fraction of desktop CPMAs your site becomes more mobile friendly, so will the mobile activity increase. Mine is usually about 50/50 weekdays & 70/30 mobile advantage on weekends.
whether IE and FF are going to follow Google's lead on this?Yup, that's the assumption and both have made statements. You can see they have already added warning icons to show where certs have improperly been implimentated. I see this as a 1st step.
mobile CPM has been a tiny fraction of desktop CPM
As your site becomes more mobile friendly, so will the mobile activity increase. Mine is usually about 50/50 weekdays & 70/30 mobile advantage on weekends.
if all of my users move to mobile, I'll be out of businessConsidering all the signals, mobile will continue to gain dominance across markets. It would be prudent to consider developing your interests in that direction.
<script>
// getCookie() and setCookie() are separate functions, and 'user' is the name of the
// cookie set for users that are logged in
var user = getCookie('user');
if (window.location.protocol == 'http:') {
// Resets my cookie using "domain=" and "path=", which weren't originally set
setCookie('user', user);
var str = window.location.href;
str = str.substring(str.indexOf('://') + 1);
window.location = 'https://' + str;
}
</script>RewriteEngine On
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
I think I'm going to do it with Javascript instead of .htaccessDidn't you just get through saying that your area has a lot of dialup? Anything involving javascript can only happen after the original (wrong) request has been loaded up, which is not likely to make your users happy.
[R,L]I hope that was a typo. It should always be [R=301,L] unless it truly is a temporary redirect and you're moving back to the old address next week.
Didn't you just get through saying that your area has a lot of dialup? Anything involving javascript can only happen after the original (wrong) request has been loaded up, which is not likely to make your users happy.
[R,L]
I hope that was a typo. It should always be [R=301,L] unless it truly is a temporary redirect and you're moving back to the old address next week.
Incidentally, mod_rewrite is perfectly happy to set (using the [CO] flag) and read (using the HTTP_COOKIE RewriteCond) cookies. So I hope that isn't your reason for using javascript.
RewriteCond %{HTTP_COOKIE} user
Header set Set-Cookie "user=%{HTTP_COOKIE}; path=/; domain=[not sure how to get my domain?]"- Guide to installing SSL and certificate on IIS
- if I can just use one certificate or is it better with 4
- What is the difference of a free vs paid one
