If you want, google the concept of “https everywhere” — the idea is that as the web moves to mobile everything as the “main” daily driver, it needs to be secure since it’s “over the air” — so, somebody sitting in a café, in the break room, on the bus, isn’t been spied upon. So, the push for “https everywhere” is to make the connections from mobile devices to web properties more secure, and enforce encrypted connections, while also deprecating insecure SSL technologies like SSL3/TLS1/TLS1.1 etc. — so, Google is giving a ranking boost for mobile rankings for https *NOW* as they do for mobile speed and mobile compatibility/UX/speed.
It’s not a huge ranking factor, but it *is* a mobile ranking factor *now* and so it’s something to think about, but ideally in 3 years it is likely to be a semi-mandatory thing. The web needs to be secure, and hijacking is a big issue and “man in the middle” hacks are also common with wireless/wifi, etc. — this is how hotels can overlay ads on your mobile connection (!).
So … I would say, for a major business portal it’s good to go https now. If you have huge traffic and make your living on your website, then now is good time to start. If you have a blog on the side, not so much.
Part of the push for “https everywhere” is also to find a solution for free/zero cost/shared SSL certificate tech — which is coming into being and is “transitional” — shared SSL certs on servers are a new thing, but not fully supported in browsers YET.
If you can afford $25 a year for cheap SSL cert for your site, it’s worth doing. If you don’t make any money from your site, wait for the free or “included with hosting” SSL certs which should be in play by end of NEXT year.
And to be clear — the only site we chose to do this on is our MAIN business site, which has been online over 15 years and which generates 90% of our income. Our news portals are not yet https, although the web server on which they reside does have SSL cert itself. Our sites running tagdiv themes are NOT yet SSL, and will not be until the whole concept of zero cost / low cost SSL certs becomes available as part of this “movement.”
For our main site we got a wildcard SSL cert so we could also make subdomains SSL, which needed to happen for our local image server and our shortcode (YOURLS) system.
You have to add a CORS instruction at your CDN for “cross domain” loading of fonts.
so you need to add this to your htaccess setting at your CDN:
# Apache config
<FilesMatch ".(eot|ttf|otf|woff)">
Header set Access-Control-Allow-Origin "*"
</FilesMatch>nginx
location ~* \.(eot|otf|ttf|woff)$ {
add_header Access-Control-Allow-Origin *;
}See the support for your CDN on how to do this.
Alternately, you can load the fonts locally for the icons.
Hope that helped. See FAQs for your CDN as they should have help on this.
