Do eCommerce websites need HTTPS?
Google Chrome urges non-HTTPS websites to have SSL from January 2017. Legitimate owners, say Google, without HTTPS should act before the deadline. The move means that legitimate website operators without HTTPS websites could be forced to install SSL on their website.
Google will start to downgrade HTTP sites on its Chrome browser from January 2017 by marking them out as less secure in a bid to stop people visiting sites run by crooks and scammers. This is a great idea - in principle - but such a shame to insist upon for those legitimate websites that have forms on their site but don't actually 'need' SSL.
What is HTTPS?
HTTPS stands for Hyper Text Transfer Protocol Secure and is the secure version of HTTP. - the protocol over which data is sent between your browser and the website to which you are connected. The 'S' at the end of HTTPS stands for 'Secure'. It means all communications (i.e. the fillling in and 'sending' of forms) between your browser and the website are encrypted.
What is SSL?
SSL stands for Secure Sockets Layer. SSL is a standard security technology for establishing an encrypted link between a web server and a browser. This link ensures that all data passed between the web server and browsers remain private and integral, providing the visual padlock and the URL to change from HTTP to HTTPS.
Why do I need HTTPS on my website now?
"To help users browse the web safely, Chrome indicates connection security with an icon in the address bar. Historically, Chrome has not explicitly labelled HTTP connections as non-secure," said Emily Schechter from the Chrome Security team in a blog post.
"Beginning in January 2017 (Chrome 56), we'll mark HTTP sites that transmit passwords or credit cards as non-secure, as part of a long-term plan to mark all HTTP sites as non-secure. A substantial portion of web traffic has transitioned to HTTPS so far, and HTTPS use is consistently increasing. We recently hit a milestone with more than half of Chrome desktop page loads now served over HTTPS. In addition, since the time we released our HTTPS report in February, 12 more of the top 100 websites have changed their serving default from HTTP to HTTPS."
Google is very keen on this sort of thing, and recently applied the HTTPS padlock sign to Gmail.
"Studies show that users do not perceive the lack of a 'secure' icon as a warning and become blind to warnings that occur too frequently. Our plan to label HTTP sites more clearly and accurately as non-secure will take place in gradual steps, based on increasingly stringent criteria," said Schechter.
"Chrome 56 will label HTTP pages with password or credit card form fields as not secure, given their particularly sensitive nature. In following releases, we will continue to extend HTTP warnings, for example, by labelling HTTP pages as ‘not secure' in Incognito mode, where users may have higher expectations of privacy.
Eventually, we plan to label all HTTP pages as non-secure, and change the HTTP security indicator to the red triangle that we use for broken HTTPS."
So, the message for those who have an eCommerce website that is currently HTTP is get a SSL certificate.
Please ask our website designers at aprompt to purchase and install your SSL certificate for your eCommerce website.
related article: Google rewards HTTPS
Written by Kirsty Paget
