Getting started with HTTPS and SSL
There is no clever trick in this one, just a handful of decisions worth making deliberately. A short on-ramp to HTTPS and SSL for teams who have not touched it before.
Security is a maintenance habit rather than a purchase, which is why it drifts. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.
What is actually at stake
Browsers now actively warn on unencrypted pages. None of that requires a large budget, only a decision and someone to own it. Budget a little time for it every quarter and it never becomes a project of its own.
Your first week
- Find out what is already in place
- Certificates can and should renew automatically
- Change one thing and measure it
Mixed content quietly breaks the padlock. It is worth being explicit about, because assumptions differ quietly. Check it against what you would want a competitor's site to get wrong.
What this looks like day to day
The realistic threat for most small businesses is automated and opportunistic, not targeted. Three things worth confirming about HTTPS and SSL before you move on:
- Someone can say what the current setup is without going to look
- Mixed content quietly breaks the padlock — and you know whether that is true here
- There is a way to tell whether the last change to this helped
If any of that sounds like a description of your current setup, it is fixable.