I’ve moved my site from http to https and have had a hard time getting the legacy data and articles to point to the https version of the images. My host suggested it might be a theme issue and to check in with you.
I had to do this recently and there are several things you can do
a) in your wp-config.php file add the express link to your site with https; this helps WP know “everything” should be https; WP should then in most cases do a 301 redirect for you. Should fix canonical issues, too.
e.g.,
define('WP_HOME', 'https://site.com');
define('WP_SITEURL', 'https://site.com');Be sure to use either www or without www — and only do that ONE way, not both! Some SSL setups require the www.
b) you can edit your content via phpmyadmin to do a search replace for all images and internal links using http://mysite to https://mysite — as those are hard-coded in the text and no way to automagically change them. Dbase search/replace best way.
there are tools to do this such as the WP CLI plugin:
http://wp-cli.org/commands/search-replace/
c) ideally you may need to add a 301 redirect for “any” request made to site to serve only the https version so you don’t have two versions of site being served.
Hi Chris,
I want to move my Newsmag site to https. Did you geht any ranking improvement since the change to https? And how does it impact the speed of the site?
Thanks!
I’ve done this and there’s a lot to consider. It’s a bit finicky to get it working 100%, but once you do, I found that the speed is actually better, and not worse. That would have a positive ranking impact.
As far as ranking goes, there needs to be consideration that the http and https are considered two separate domains and, even when you 301 redirect them, you’re losing some link juice off of them. A 301 redirect URL/link maintains about 90% of it’s value, so you’re actually hurting the site from an SEO standpoint.
We organized all of the backlinks to the site and prioritized them from most important to least important. Then we contacted each and every webmaster and asked them to update the links from http to https to minimize the loss.
I don’t expect that https has a huge ranking benefit, and if you don’t fix your backlinks, it’s a negative with regards to SEO. If there’s a tie breaker for two results, the winner goes to the site with https—that’s how we see it.
TL;DL – you’ll get a speed boost (if done correctly), update your backlinks to point to the https version of the site, and the ranking impact is slight and will probably only be in the 1-3% area, in my experience.
https runs a little slower generally due to the overall issue of encryption, but many servers are now being optimized with things like mod_SPDY which is framework being baked into next versions of web, apache, etc.
We did see some hiccups on our main site last Dec. moving to https; basically in webmaster tools (search console) you end up with two sites as they STILL don’t have a “move site from http to https” function. The main weirdness was the huge drop of “inbound links/sites” going from one million plus to 250,000 or so … this is because the other sites are linking to http version of site — which is a different site in Googleverse —
However the rankings went back to normal on our main site after awhile.
Of course having a UX score of 100 on pagespeed insights didn’t hurt either!
The sitewide 301 redirect is simple enough, as is editing your dbase to change all the embedded image stuff from http to https …
There are just the general weirdness in the inbound link volume and the whacky issue of having two sets of sites listed in your Google console; one being live, one being deprecated.
I got a note about the deprecated site in Spring reminding me about mobile fixes … um, right Google — for the deprecated site? Duh.
Https is not as much a slowdown as it used to be as servers are faster, disks faster, most servers now have gigabit switches vs 10/100 (get better host if they only have 10/100).
🙂
Okay thanks for your answers!!! 🙂
I think I will wait with this. It seems there is no major impact on the rankings, right?
Hi guys,
nice topic, I’ve been trying to learn more about it.
When you guys say “move to https” do you mean that your website will be exclusively https and http will no longer be available?
I did nothing like you and so I’m a bit apprehensive, although my point in having https was to “secure” just a small part of the site like wp-admin, logins and the store.
I did not change WP_HOME/SITEURL, just added define(‘FORCE_SSL_ADMIN’, true), so I guess wordpress is oblivious to connection. WP supercache creates static pages for https as well and performance seems unaffected. Site operates apparently well: I’m on http, click the login link and it goes https, I login and it throws me back to http afterwards. I browse the site, it stays http, and if I click in the edit my profile link for example, it switches me back to https, login session is always kept.
No mixed contents so far, padlock goes green. I plan to move my images to a subdomain and the SSL certificate only covers the domain. Tested a redirect from subdomain to domain folder and the padlock was green too. I also use cloudflare in strict mode: server <ssl> cloudflare <ssl> user
Ranking in google looked the same to me, it’s a fairly new site and it was growing slowly but steadily and still is. I ranked a few 1st places (regionally) in small subjects and even ranked a major one recently!
Again, as I know little about this and I’m probably doing big time shit, google tried to sort things out. It doesn’t rank both versions of the site, it chooses one. Everything’s http, except for the homepage and what google thinks its sensitive, like the wc cart page for example. Curiously, I have a page called “online reservations”, no online reservations are made whatsoever it’s just an article about it. Google ranks it https :). And google mix those because, regionally, my site gets that submenu under the search result and those sub-entries are either http or https accordingly to google’s criteria.
Cart page is fine and all that but I think I’d rather have the home page raking as http. Should I use a redirect or use webmastertools to exclude https version?
Any notes on this will be highly appreciated, it’s a topic I’m pretty noob at and we gotta learn everyday, thanks guys!
Cheers
If you want, google the concept of “https everywhere” — the idea is that as the web moves to mobile everything as the “main” daily driver, it needs to be secure since it’s “over the air” — so, somebody sitting in a café, in the break room, on the bus, isn’t been spied upon. So, the push for “https everywhere” is to make the connections from mobile devices to web properties more secure, and enforce encrypted connections, while also deprecating insecure SSL technologies like SSL3/TLS1/TLS1.1 etc. — so, Google is giving a ranking boost for mobile rankings for https *NOW* as they do for mobile speed and mobile compatibility/UX/speed.
It’s not a huge ranking factor, but it *is* a mobile ranking factor *now* and so it’s something to think about, but ideally in 3 years it is likely to be a semi-mandatory thing. The web needs to be secure, and hijacking is a big issue and “man in the middle” hacks are also common with wireless/wifi, etc. — this is how hotels can overlay ads on your mobile connection (!).
So … I would say, for a major business portal it’s good to go https now. If you have huge traffic and make your living on your website, then now is good time to start. If you have a blog on the side, not so much.
Part of the push for “https everywhere” is also to find a solution for free/zero cost/shared SSL certificate tech — which is coming into being and is “transitional” — shared SSL certs on servers are a new thing, but not fully supported in browsers YET.
If you can afford $25 a year for cheap SSL cert for your site, it’s worth doing. If you don’t make any money from your site, wait for the free or “included with hosting” SSL certs which should be in play by end of NEXT year.
And to be clear — the only site we chose to do this on is our MAIN business site, which has been online over 15 years and which generates 90% of our income. Our news portals are not yet https, although the web server on which they reside does have SSL cert itself. Our sites running tagdiv themes are NOT yet SSL, and will not be until the whole concept of zero cost / low cost SSL certs becomes available as part of this “movement.”
For our main site we got a wildcard SSL cert so we could also make subdomains SSL, which needed to happen for our local image server and our shortcode (YOURLS) system.
Thanks for your input Chris, always a good read! SSL seems indeed the way to go and I do think I had a small rank boost because of it, even though I made a mess of it.
I have to learn more about using canonical link element correctly, make some choices and then set things straight so hopefully I get google to rank http or https at my discretion while not losing the rank boost.
$25/yr for SSL is really cheap! Got mine for free (1yr) when I recently moved on to a better server (siteground) but renewal will be $65 and it’s not “wildcarded”. Guess I’ll try to negotiate with them when the time comes 🙂
Thanks for your words again, I’ll get back at this if I get more knowledge and experience worth discussion.
Cheers!
(Indeed, funky shit at word break! FF/WIN7-64)
We opted to make “https everywhere” since Google prefers that for mobile — meaning ALL pages, not just ecom/store — even the privacy policy. This ensures you have ONE canonical version with https always and don’t have to juggle that (nightmare I say!) in WP and Yoast.
There are some cheaper SSL certs out there if you shop around.
We use Godaddy for our main business site SSL cert since our DNS is there (or rather domain > nameservers > our local DNS.
For main server SSL, we’re using our long time pals (they do NOT host our server which is at SoftLayer in Dallas, an IBM company) — TSS – https://my-tss.com/ssl-certificates.php
A RapidSSL cert is $20/year and suitable for most sites not doing enterprise level stuff. Wildcard cert is $129/year. Which is typical.
I think we pay $135 for the wildcard cert via Godaddy, but again that’s for our main business portal and NOT for our news sites. We’ll be securing CaliforniaNewswire.com likely early in 2016, and using the $20 option.
Peace out !
Back to work on my damn WooCommerce store … what a nightmare … sheesh. Cubecart 5 had 7 updates in 6 years. WordPress + Plugins + WooCommerce + Extensions I think is up to 50 updates since Spring. Wild, simply wild. Want a career ? Become a WooCommerce Ninja … seriously.
I will likely start a consulting business just to help people keep their WooCommerce sites working.
Oops… back to work ! 😉
When I called my host (Inmotion Hosting), they said that they could just switch my site from http to https without doing any 301 redirects. Is that true? From what you said above it sounds a lot more complicated…
As an update to this older thread; most hosting providers worth their salt are now moving to support “https everywhere” initiative with free SSL certs for https via “Let’s Encrypt,” even on shared IPs. Note using this type of cert will mean OOOOOLD web broswers might not be able to access website at all since they can’t support modern secure standards — and, really, should NOT even be used on the web. SO, some kind of ‘sniffer’ to say “hey, dummy, update your browser to Chrome…” is worthwhile.
you should also add a block like so in your htaccess file above the #wordpress stuff…
e.g., (note; this example is using pretty permalinks with post name; so don’t use my wordpress code unless you want to; this is just example of how to put in the EXTRA stuff ABOVE the #wordpress stuff!)
**this presumes APACHE server.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
</IfModule>
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>ALSO: in your wp-config.php file, this is useful:
define('WP_HOME', 'https://SITEHERE.com');
define('WP_SITEURL', 'https://SITEHERE.com');
define('WP_CONTENT_URL', 'https://SITEHERE.com/wp-content' );
define('WP_PLUGIN_URL', 'https://SITEHERE.com/wp-content/plugins' );
define('FORCE_SSL_ADMIN', true);Finally, in some setups you might find this more useful to put at top of htaccess than my first example — basically a slightly different way of doing it:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,QSA]
</IfModule>*updated : Oct. 27, 2016 / 12:19pm PDT.
ALSO note that many hosting panels can do basic http > https redirect at the hosting panel after the SSL/https cert is setup.
In practice however, what I have found on CentOS/Plesk/Apache with “Let’s Encrypt” that Chrome still continues to allow, and the server, continues to allow loading via http, and so it throws up errors in Chrome for mixed content.
As always, after doing all these shenanigans, test your site in a web browser to ensure you do have ‘lock’ on all pages/posts; keeping in mind the errant AdSense ad might throw an error you can’t do anything about unless you opt for text-only ads.
