{"id":32014,"date":"2017-09-29T16:43:02","date_gmt":"2017-09-29T13:43:02","guid":{"rendered":"https:\/\/blog.superhosting.bg?p=32014"},"modified":"2022-06-02T17:41:29","modified_gmt":"2022-06-02T14:41:29","slug":"next-step-to-make-the-web-more-secure-and-autossl","status":"publish","type":"post","link":"https:\/\/blog.superhosting.bg\/en\/next-step-to-make-the-web-more-secure-and-autossl.html","title":{"rendered":"Google Takes the Next Step Towards a More Secure (HTTPS) Web, SuperHosting.BG Also Moves on With AutoSSL"},"content":{"rendered":"<p>Google\u2019s plan for a more secure web is still in progress as the key tool for its implementation is the&nbsp;<a title=\"Marking HTTP As Non-Secure | chromium.org\" href=\"https:\/\/www.chromium.org\/Home\/chromium-security\/marking-http-as-non-secure\/\" target=\"_blank\" rel=\"noopener noreferrer\">Chrome Web Browser<\/a>. The next phase of marking HTTP as non-secure web element has already started. As of October 2017&nbsp;<a title=\"Next Steps Toward More Connection Security | security.googleblog.com\" href=\"https:\/\/security.googleblog.com\/2017\/04\/next-steps-toward-more-connection.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google Chrome v.62<\/a> will display a <strong>Not Secure<\/strong> warning message in front of all HTTP pages containing forms no matter if their purpose is logging in, comments, feedback or other.&nbsp;<a title=\"Upcoming Changes in Web Security Standards\" href=\"https:\/\/blog.superhosting.bg\/en\/it-is-time-for-ssl-to-make-the-web-more-secure.html\" target=\"_blank\" rel=\"noopener noreferrer\">Until recently<\/a>&nbsp;this notification was displayed only for HTTP pages with password or credit card form fields.<\/p>\n<p><strong>Chrome v.62&nbsp;<\/strong>will display the <strong>Not Secure<\/strong> message in front of all HTTP pages with forms.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-31911 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-55-https-everywhere-http-login-note-01-1.png\" alt=\"Not Secure\" width=\"552\" height=\"36\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-55-https-everywhere-http-login-note-01-1.png 552w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-55-https-everywhere-http-login-note-01-1-300x20.png 300w\" sizes=\"auto, (max-width: 552px) 100vw, 552px\" \/><\/p>\n<h4><strong>Mozilla Firefox will do the same!<\/strong><\/h4>\n<p>Many big companies followed Google\u2019s steps towards the idea of <a title=\"Google I\/O 2014 - HTTPS Everywhere | Google Developers youtube.com\" href=\"https:\/\/www.youtube.com\/watch?v=cBhZ6S0PFCY\" target=\"_blank\" rel=\"noopener noreferrer\">HTTPS everywhere<\/a>. Mozilla also plans to&nbsp;<a title=\"Deprecating Non-Secure HTTP\" href=\"https:\/\/blog.mozilla.org\/security\/2015\/04\/30\/deprecating-non-secure-http\/\" target=\"_blank\" rel=\"noopener noreferrer\">drop the non-secure HTTP<\/a>&nbsp;in Firefox.<\/p>\n<p>Firefox v.51&nbsp;will start displaying a crossed out lock in the address bar on all sites that don\u2019t use HTTPS and contain a login form.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-31914 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1.png\" alt=\"Not Secure\" width=\"436\" height=\"42\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1.png 436w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1-300x29.png 300w\" sizes=\"auto, (max-width: 436px) 100vw, 436px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 alignright wp-image-31948 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-52-http-login-note-02-1.png\" alt=\"Not Secure\" width=\"268\" height=\"102\"><\/p>\n<p>Firefox 52&nbsp;will visibly display a warning message in the fields of a login form when a certain webpage loads via HTTP. A broken lock icon will also be loaded in the address bar.<\/p>\n<h4 class=\"h4-gray01\"><strong>The Next Step for Chrome and Firefox<\/strong><\/h4>\n<p>Google and Mozilla announce one and the same goal in their plan to quit the non-secure HTTP \u2013 their browsers will soon start marking in red each page that doesn\u2019t use HTTPS no matter what its contents are.<\/p>\n<p><strong>Firefox<\/strong>&nbsp;will&nbsp;<a title=\"Firefox will eventually display the struck-through lock icon for all pages that don\u2019t use HTTPS\" href=\"https:\/\/blog.mozilla.org\/security\/2017\/01\/20\/communicating-the-dangers-of-non-secure-http\/\" target=\"_blank\" rel=\"noopener noreferrer\">display<\/a>&nbsp;the crossed out lock for every HTTP webpage.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-31914 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1.png\" alt=\"Not Secure\" width=\"436\" height=\"42\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1.png 436w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-firefox-51-http-login-note-01-1-300x29.png 300w\" sizes=\"auto, (max-width: 436px) 100vw, 436px\" \/><\/p>\n<p><strong>Google&nbsp;Chrome<\/strong>&nbsp;<a title=\"&quot;we plan to label all HTTP pages as non-secure&quot; | security.googleblog.com\" href=\"https:\/\/security.googleblog.com\/2016\/09\/moving-towards-more-secure-web.html\" target=\"_blank\" rel=\"noopener noreferrer\">will display<\/a>&nbsp;a triangle in red, containing the Not Secure notification.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-31919 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-http-website-note-01-1.png\" alt=\"Not Secure\" width=\"552\" height=\"36\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-http-website-note-01-1.png 552w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-http-website-note-01-1-300x20.png 300w\" sizes=\"auto, (max-width: 552px) 100vw, 552px\" \/><\/p>\n<p>Some users may not have paid much attention to an HTTP\u2019s URL, but from now on it will be much easier since its shining red appearance. This surely will make visitors uncomfortable and they might start avoiding such websites. Many HTTP websites will lose the trust and attention of their regular users, especially if they are online stores or handle sensitive data.<\/p>\n<p>Luckily this time has not come yet and all HTTP websites still have time to migrate to HTTPS (or HTTP\/2).<\/p>\n<div class=\"tipsupport04\"><em style=\"color: #666666; font-family: Trebuchet MS,Verdana,sans-serif; font-size: 16px;\"><strong>HTTPS (+HTTP\/2)<\/strong><\/em><br \/>\nIf you still have not migrated to HTTPS here are some benefits and reasons fair enough to convince you into finally doing it:<\/p>\n<ul class=\"listgsquare\">\n<li><strong>Secure User Connection.<\/strong><br \/>\nThe secure HTTPS connection protects your visitors\u2019 data from interception or counterfeiting. This is crucially important for activities such as online banking, shopping, communication or others.<\/li>\n<li><strong>Website Protection<\/strong><br \/>\nSecure HTTPS connection between the user and a website protects the website itself by preventing third parties\u2019 access and modification before the content reaches the user&#8217;s browser.<\/li>\n<li><strong>Better Ranking on&nbsp;<a title=\"HTTPS as a ranking signal | security.googleblog.com\" href=\"https:\/\/security.googleblog.com\/2014\/08\/https-as-ranking-signal_6.html\" target=\"_blank\" rel=\"noopener noreferrer\">Google<\/a>.<\/strong><\/li>\n<li><strong>Creating Reliability and Sense of Security.<\/strong><br \/>\nAll web browsers will mark the website as secure by adding a green icon next to its URL and a text stimulating all your visitors\u2019 trust.<\/li>\n<li><strong>Speeding up Your Website<\/strong><br \/>\nHTTPS will enable the connection between the website and its visitors to work with the newer and faster <a title=\"Actual HTTP\/2: A faster website and more\" href=\"https:\/\/blog.superhosting.bg\/en\/your-website-supports-http2.html\" target=\"_blank\" rel=\"noopener noreferrer\">HTTP\/2 protocol<\/a>.<\/li>\n<\/ul>\n<\/div>\n<h4 class=\"h4-gray01\"><strong>You host a website with us, but still do not have an SSL certificate?<\/strong><\/h4>\n<p>Do not worry! You can test HTTPS right now, because your website already has an installed SSL certificate. The only thing that you need to do is enable the secure HTTPS connection in your website&#8217;s settings. Please note that the SSL certificate is installed in your hosting account, but enabling the HTTPS connection is up to you.<\/p>\n<p>All SuperHosting.BG customers that still have not installed an SSL certificate are secured by such and they do not need to install another one. All domains pointed to a hosting account by SuperHosting.BG have installed&nbsp;free cPanel\/Comodo SSL certificate by default.<\/p>\n<p>Open your website in a new tab by adding https:\/\/ at the beginning of the URL. You will see the green lock no matter what your browser is.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"img-border2 aligncenter wp-image-31921 size-full\" src=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-https-website-note-01-1.png\" alt=\"Secure\" width=\"552\" height=\"36\" srcset=\"https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-https-website-note-01-1.png 552w, https:\/\/blog.superhosting.bg\/wp-content\/uploads\/2017\/09\/google-chrome-https-everywhere-https-website-note-01-1-300x20.png 300w\" sizes=\"auto, (max-width: 552px) 100vw, 552px\" \/><\/p>\n<p>If, after the website is loaded, the icon does not display a green lock, this means that the site is not completely HTTPS ready. You have to work a bit more on its settings. All non-secure HTTP resources will <a title=\"HTTPS - Part of the Website\u2019s Content is Loaded over an Insecure Connection (HTTP)\" href=\"https:\/\/help.superhosting.bg\/en\/the-connection-to-this-website-is-not-fully-secure.html\" target=\"_blank\" rel=\"noopener noreferrer\">need to be&nbsp;changed to HTTPS<\/a>. If you own a WordPress website, changing non-secure HTTP resources to HTTPS can be&nbsp;<a title=\"SSL Activation - WordPress Manager by SuperHosting\" href=\"https:\/\/help.superhosting.bg\/en\/wp-manager-instant-ssl-installation-and-activation.html\" target=\"_blank\" rel=\"noopener noreferrer\">automatically performed through WordPress Manager<\/a>&nbsp;in cPanel.<\/p>\n<p>In case of an error message displayed while loading a HTTPS website, please send a query to our Technical Support Department.<\/p>\n<h4 class=\"h4-gray01\"><strong>cPanel AutoSSL \u2013 SSL certificate for each domain<\/strong><\/h4>\n<p>Recently we enabled the&nbsp;AutoSSL feature for all&nbsp;<a title=\"All SSD Hosting with Unlimited Bandwidth and Overall Security!\" href=\"https:\/\/en.superhosting.bg\/web-hosting-compare-hosting-plans.php\" target=\"_blank\" rel=\"noopener noreferrer\">hosting plans<\/a>&nbsp;and&nbsp;<a title=\"Managed VPS\" href=\"https:\/\/en.superhosting.bg\/web-hosting-common-managed-vps.php\" target=\"_blank\" rel=\"noopener noreferrer\">Managed VPS<\/a>&nbsp;servers. This is a system feature in cPanel\/WHM that allows you to automatically install SSL certificates.<\/p>\n<p>The new SSL certificates installed via AutoSSL are specially developed by cPanel in cooperation with Comodo. The cPanel\/Comodo certificates have the same parameters as&nbsp;<a title=\"Let\u2019s Encrypt Certificate\" href=\"https:\/\/help.superhosting.bg\/en\/lets-encrypt.html\" target=\"_blank\" rel=\"noopener noreferrer\">Let\u2019s Encrypt<\/a>. They are completely free, issued for a 3 months period and are automatically renewed. The only difference with Let\u2019s Encrypt is that here the certificate is automatically installed without requiring the participation of any user.<\/p>\n<p>Installing an SSL certificate requires placing a few system files into your hosting account. However, to enable a secure HTTPS connection, the admin needs to perform a further setup in the website.<\/p>\n<p>The free SSL certificate by cPanel\/Comodo can be viewed by going to cPanel \u2013 menu \u201eSSL\/TLS\u201c-&gt; \u201eManaging SSL Certificates\u201c.<\/p>\n<p>For more information about AutoSSL, please visit&nbsp;our help page.&nbsp;cPanel AutoSSL \u2013 SSL certificate for each domain<\/p>\n<h4 class=\"h4-gray01\"><strong>Short guide for migrating from HTTP to HTTPS<\/strong><\/h4>\n<p><strong>1. Activate the secure HTTPS connection<\/strong><\/p>\n<p>You can manually enable HTTPS in WordPress by modifying settings in the&nbsp;<strong>General section<\/strong> and then&nbsp;<strong>Settings<\/strong>. For the <strong>WordPress URL<\/strong> and <strong>URL options<\/strong> you need to change the URL from http:\/\/ to&nbsp;<strong>https:\/\/<\/strong>.<\/p>\n<p><strong>Automatic HTTPS Activation<\/strong>&nbsp;for WordPress can be performed with the&nbsp;<a title=\"Move - WordPress Manager by SuperHosting\" href=\"https:\/\/help.superhosting.bg\/en\/wp-manager-move.html\" target=\"_blank\" rel=\"noopener noreferrer\">Move<\/a>&nbsp;option available in&nbsp;<a title=\"WordPress Manager by SuperHosting\" href=\"https:\/\/help.superhosting.bg\/wordpress-manager-by-superhosting.html\" target=\"_blank\" rel=\"noopener noreferrer\">WordPress Manager<\/a>&nbsp;in cPanel. When doing this you need to change the URL protocol, for example: http:\/\/mysupersite.com has to be changed into:&nbsp;https:\/\/mysupersite.com. After you finish the procedure, use the option <a title=\"SSL Activation - WordPress Manager by SuperHosting\" href=\"https:\/\/help.superhosting.bg\/en\/wp-manager-instant-ssl-installation-and-activation.html\" target=\"_blank\" rel=\"noopener noreferrer\">Check for HTTP Resources (loaded on HTTPS Website)<\/a>. The option allows you to automatically edit the HTTP resources in your website so that they start loading via HTTPS.<\/p>\n<p>For websites powered by another CMS, check their settings or help documentation.<\/p>\n<p><strong>2. Update all HTTP Website Resources to HTTPS<\/strong><\/p>\n<p>If the website is running on WordPress you can automatically update all HTTP resources to HTTPS by using cPanel -&gt; WordPress Manager and clicking on <a title=\"SSL Activation - WordPress Manager by SuperHosting\" href=\"https:\/\/help.superhosting.bg\/en\/wp-manager-instant-ssl-installation-and-activation.html\" target=\"_blank\" rel=\"noopener noreferrer\">Check for HTTP Resources (loaded on HTTPS Website)<\/a>.<\/p>\n<p>For websites running on other CMS&nbsp;you can <a title=\"HTTPS - Part of the Website\u2019s Content is Loaded over an Insecure Connection (HTTP)\" href=\"https:\/\/help.superhosting.bg\/en\/the-connection-to-this-website-is-not-fully-secure.html\" target=\"_blank\" rel=\"noopener noreferrer\">check and change the HTTP resources manually<\/a>.<\/p>\n<p><strong>3. Set up 301 Redirecting to New HTTPS URLs<\/strong><\/p>\n<p>Setting up 301 Redirecting to New HTTPS URLs&nbsp;can be implemented by using a few .htaccess rules. For example, add the following code below the RewriteEngine On line:<\/p>\n<div class=\"text-note-small\">RewriteCond %{HTTPS} off<br \/>\nRewriteRule (.*) https:\/\/%{SERVER_NAME}\/$1 [R=301,L]<\/div>\n<p>By doing this you will redirect your website and all its pages to always loading through HTTPS.<\/p>\n<p><strong>4. Check and Set up Canonical URLs<\/strong><\/p>\n<p>After the website is already loaded only via HTTPS, check whether the webpages code contains&nbsp;a <a title=\"Use canonical URLs\" href=\"https:\/\/developers.google.com\/search\/docs\/advanced\/crawling\/consolidate-duplicate-urls\" target=\"_blank\" rel=\"noopener noreferrer\">correct meta tag rel=\u201ccanonical\u201c<\/a>. The canonical Address should be HTTPS. If you have a WordPress website and up to now you used a plugin to generate meta tags, you only need to check if they begin with https:\/\/.<\/p>\n<p><strong>5. Google Search Console and Google Analytics<\/strong><\/p>\n<p>After the website already loads through HTTPS you will need to change the URL in the respective Google tools by replacing the old http:\/\/ with the new https:\/\/.<\/p>\n<p>You first need to add the website starting with https:\/\/ in the Google Search Console as a new website.<\/p>\n<p>After opening&nbsp;<strong>Google Search Console<\/strong>&nbsp;go to the Home page and&nbsp;<strong>Add a Property<\/strong>.<\/p>\n<p>5.1. <strong>Add a Property<\/strong>. Add your website\u2019s URL starting with https:\/\/ (e.g. https:\/\/mysupersite.com\/).<\/p>\n<p>5.2. <strong>Sitemaps<\/strong>. Submit the sitemap starting with https:\/\/ (e.g. https:\/\/mysupersite.com\/sitemap.xml).<\/p>\n<p>5.3. <strong>Fetch as Google<\/strong>. After Google verifies the website, enable indexing and the related links \u2013&nbsp;<strong>Request indexing<\/strong>&nbsp;-&gt;&nbsp;<strong>Crawl this URL and its direct links&nbsp;\u2013&nbsp;Go.<\/strong><\/p>\n<p>5.4. <strong>Google Analytics<\/strong>.&nbsp;Log into your Analytics profile and access the&nbsp;<strong>Admin<\/strong> settings.&nbsp;In both sections:&nbsp;<strong>Property Settings<\/strong>&nbsp;and&nbsp;<strong>View Settings<\/strong>&nbsp;change the&nbsp;<strong>Default URL<\/strong>&nbsp;from http:\/\/ to&nbsp;<strong>https:\/\/<\/strong>. Save all changes.<\/p>\n<p>Read more information for migrating from HTTP to HTTPS on Google:&nbsp;<a title=\"Overview: Site moves with URL changes\" href=\"https:\/\/developers.google.com\/search\/docs\/advanced\/crawling\/site-move-with-url-changes\" target=\"_blank\" rel=\"noopener noreferrer\">HTTP\u2013&gt;HTTPS migration FAQs<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google\u2019s plan for a more secure web is still in progress as the key tool for its implementation is the\u00a0Chrome Web Browser. <\/p>\n","protected":false},"author":16,"featured_media":66569,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_lmt_disableupdate":"no","_lmt_disable":"no","footnotes":""},"categories":[126],"tags":[212,128,367],"class_list":{"0":"post-32014","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-superhosting-news-en","8":"tag-improvements","9":"tag-security-and-protection-in-internet","10":"tag-ssl-certificates"},"aioseo_notices":[],"modified_by":"\u041c\u0430\u0434\u043b\u0435\u043d\u0430 \u041c\u0435\u0442\u043e\u0434\u0438\u0435\u0432\u0430","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/32014","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/users\/16"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/comments?post=32014"}],"version-history":[{"count":9,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/32014\/revisions"}],"predecessor-version":[{"id":66570,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/posts\/32014\/revisions\/66570"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/media\/66569"}],"wp:attachment":[{"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/media?parent=32014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/categories?post=32014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.superhosting.bg\/en\/wp-json\/wp\/v2\/tags?post=32014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}