Check your hosting control panel: many hosts now issue free certificates that renew automatically. Then switch the whole site to HTTPS with redirects, and fix every image, script and embed still loading over plain HTTP.

The certificate may already be there

For years the case against moving a small site to HTTPS was cost: a certificate bought every year, plus someone's time to install and renew it.

That case has mostly gone. Let's Encrypt has issued free certificates since last year, and many hosting control panels now request one for every domain on the account and renew it automatically.

Some sites have had a valid free certificate sitting unused for months. The host issued it, nobody switched the site over, and switching is the part that still needs care.

Why it matters more this year

Since January, Chrome has marked plain HTTP pages with a password or card field as not secure, and Firefox shows a struck-through padlock on pages with a password box.

Last month Google announced that Chrome 62, due in October, will flag a plain HTTP page the moment someone starts typing in a form, and will flag all such pages in Incognito windows.

That includes contact forms, quote requests and booking forms: the pages where a small business most needs a visitor to keep going.

What to look for in the control panel

The fifth matters most. Free certificates usually last ninety days, so they depend on renewing themselves: automatic renewal makes them effortless, and manual renewal makes them a quarterly chore someone will forget.

Free versus paid

A free certificate is domain validated: it confirms that whoever requested it controls the domain. It gives the same padlock and the same encryption as a paid certificate of that type.

Paid certificates still make sense where you want the company name shown beside the address, which needs extended validation, or where a payment provider asks for a particular kind.

For a typical site with a contact form, the free one does the job.

Switching the site over properly

Take a backup, then change the site's own address to the https version. On WordPress that means the two address fields under Settings, then General.

Redirect every plain HTTP address permanently to its secure version at the server, so old links, bookmarks and search results all arrive on the secure page.

Update links inside the content that still start with http, using a careful search and replace on the database rather than editing page by page. And pick one version of the address, with or without www.

A worked example

A paintball park on rural acreage outside town takes group bookings through its website: birthday parties, bachelor parties and team days for local employers.

The site was on plain HTTP because the owner had been quoted a yearly price for a certificate plus installation, and kept putting it off.

The hosting control panel had in fact been issuing a free certificate for the domain since the autumn, and the park's developer switched the site over in an afternoon.

The booking page then showed an empty space where the availability calendar should have been. The calendar came from a booking service and loaded its script over plain HTTP, which browsers refuse to run on a secure page.

The service offered a secure version of its embed code, and swapping it in brought the calendar back. The gallery's photos, hard-coded with http addresses, were fixed with one search and replace.

A final check showed the padlock on every page, and the first automatic renewal went in the developer's calendar to confirm.

Insecure content on a secure page

A page served over HTTPS that pulls in anything over plain HTTP has mixed content, and browsers react to it.

Insecure images usually still load, but the padlock disappears or carries a warning. Insecure scripts, stylesheets and embedded frames are blocked outright, which can break a map, a form or a booking widget without any message a visitor would understand.

To find it, load the page in Chrome with the developer tools showing and look at the Console. Every insecure item is listed there as mixed content, with its address.

The usual sources

Images placed in old posts with full http addresses are the most common, followed by logos and backgrounds written into the theme's files.

Then come embeds pasted in years ago: maps, videos, booking calendars, review widgets and newsletter forms. Most now offer secure versions of the same code.

Scripts added for tracking or chat, and fonts loaded from an old address, complete the usual list.

After the switch

To Search Console, the https address is a new site. Add it as one, and submit its sitemap there.

Switch the default address in the Analytics property settings to https, and update the website address on your Google My Business listing, your Facebook page and email signatures.

Then submit each form on the site once. A form whose submissions still go to an http address can trigger a warning of its own.

The counter-case

A site with no forms at all is under less pressure in October, apart from visitors in Incognito mode. It still gains the padlock, and switching while things are calm is easier than under a deadline.

A host that offers no free certificate can usually install a paid one, and the switch-over work is the same either way.

A large site with years of embedded content may take longer than an afternoon, which is a reason to start sooner.

Check the control panel, switch over properly, and fix every insecure item before October.

The switch, in order

  1. Find the certificate in your control panel.
  2. Confirm it covers both www and the bare domain.
  3. Back up the site before changing anything.
  4. Change the site address to https.
  5. Redirect every HTTP address to its secure version.
  6. Fix each insecure image, script and embed.
  7. Add the https site to Search Console.

Step six is where switching properly differs from merely switching. The padlock only appears when everything on the page is secure, and a blocked script can quietly break the one form that matters.

While the control panel is open, check the account's disk usage too, as covered in when the hosting account runs out of space.

Frequently asked questions

Are free certificates as secure as paid ones?

A free domain-validated certificate gives the same padlock and encryption as a paid one of that type. Paid ones matter where you need the company name shown or a partner requires one.

How do I know if my host offers one?

Look in the control panel for a section named SSL, TLS or security. If a certificate is listed with an issuer and a renewal date, it is already there.

Why does the padlock disappear on some pages?

Because the page loads something, usually an image or a script, over plain HTTP. Chrome's developer tools list each insecure item in the Console as mixed content.

What changes in Chrome in October?

From Chrome 62, due in October, typing into any form on a plain HTTP page brings up the not secure warning, and Incognito windows show it on every such page.

Do free certificates expire?

Yes, usually after ninety days, so they rely on automatic renewal. Check that your host renews them, and note the first renewal date to confirm it happens.

What else needs updating after the switch?

Add the https version to Search Console, change the default address in Analytics, and update the website address on your listings, social profiles and email signatures.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Still on plain HTTP with forms?

Send us your address. We will check whether your host already issues a certificate and what the switch involves.

Start a Conversation