Before you invest in HTTPS and SSL

Teams tend to reach for this after something has already gone wrong. Before you spend anything on HTTPS and SSL, it is worth confirming a few things are already true.

The realistic threat for most small businesses is automated and opportunistic, not targeted. Check it against what you would want a competitor's site to get wrong.

Prerequisites

• You can describe the outcome you want in one sentence
• Someone owns it after the work is done
• Browsers now actively warn on unencrypted pages
• You have a way to tell whether it worked

Where it usually goes wrong

Certificates can and should renew automatically. The reasoning matters more than the rule, because the rule has exceptions. The failure mode is not doing it wrong, it is doing it once and assuming it stays done.

Mixed content quietly breaks the padlock. The reasoning matters more than the rule, because the rule has exceptions. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.

How to tell if yours is fine

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about HTTPS and SSL before you move on:

• Someone can say what the current setup is without going to look
• Mixed content quietly breaks the padlock — and you know whether that is true here
• There is a way to tell whether the last change to this helped

None of this needs a rewrite. Most of it is a morning's work once someone decides to do it.