Signs it is time to revisit HTTPS and SSL

This is cheap to get right at the start and expensive to retrofit. A few signals that HTTPS and SSL is due some attention.

The cheapest security work is the boring kind done on a schedule. It is the sort of thing that looks like polish right up until it costs you an enquiry.

The signals

• Nobody can say when it was last reviewed
• The answer depends on who you ask
• Browsers now actively warn on unencrypted pages
• Certificates can and should renew automatically

Where to start

Mixed content quietly breaks the padlock. Where this goes wrong is almost never a lack of knowledge. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.

What this looks like day to day

Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about HTTPS and SSL before you move on:

• Someone can say what the current setup is without going to look
• Browsers now actively warn on unencrypted pages — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Worth checking on your own setup before it becomes someone else's problem to fix.