I've upgraded a dozen sites. Absolutely no reduction in Adsense earnings after switching to HTTPS.

In fact, since browsers now show a warning when a site is *not* HTTPS, earnings should be better after upgrading.

The icons are explained here: [support.google.com...]

Moved last summer, and didn't notice any negative impact.

Also, since sometimes Google requests ads to be compliant with https, so no warning, or missing ads as it could have been the case, in the early times.

I've actually just moved my second biggest site to https (before making the move for my main earner)

I followed a guide - made sure all htaccess redirects were in place, used a program to search all pages for http to replace them with https.

Anyway - after a week, all my pages are now in webmaster tools - and adsense earnings have stayed stable. No ups, no downs. Just exactly the same.

I think 99% of ads shown are now https anyway.

Is it worth the change to https - I don't know. But it won't affect uour earnings for better or worse.

Good to know it's no longer have a major earnings impact. I supposed I just might plan for the complete switch from http to https later this year for all my sites.

Question - Which I hope is a sensible one.

How much do "bona-fide and credible" HTTPS certificates cost?

Apart from a tortuous path to my real email address via reCAPTCHA, my sites require zero input/information from site visitors.

I can never escape the conclusion that this rush to HTTPS for smaller sites is nothing more than a marketing exercise for distributors of secure certificates.

How much do "bona-fide and credible" HTTPS certificates cost?

Different certs are offered at different, but relative, prices.

I can never escape the conclusion that this rush to HTTPS for smaller sites is nothing more than a marketing exercise for distributors of secure certificates.

Use a free cert: [letsencrypt.org...]

@IanCP

I only made our forum go https, due to the login area - which was coming up Not Secure on the latest versions of Chrome and Firefox.

I don't see a need to make my frontend or other sections go HTTPS, at least not right now.

I don't see a need to make my frontend or other sections go HTTPS, at least not right now.

Really? You don't think seeing a big red warning will scare your visitors away?

Have you seen how the 10 most common browsers warn visitors that your site in not secure? That their information is not safe? And these browser warnings will become more explicit over time.

The current warnings: [support.google.com...]

How much do "bona-fide and credible" HTTPS certificates cost?

The basic ones (domain validation) I buy at $7.99/year. Haven't tried Let's Encrypt yet, seemed more of a hassle so I'm just sticking to the cheap ones I'm familiar with :-)

And no, going HTTPS should not have a negative effect on your AdSense earnings, so long as your implementation is correct (use the Qualys SSL Labs check).

I also don't really see the point of moving only part of a site to HTTPS, when you will have to eventually move everything over anyway. You did mention it's going to be a lot of work adjusting your CMS, but I find that hard to imagine; there must be a way to make that easier. It's just a protocol change, after all.

Running lots of sites with Let's Encrypt certs. Started moving over the HTTPS in September. I think I planned the moves reasonably well. Made sure sitemaps, canonical links and htaccess were all updated, along with any links under my control.

Anyway, so far I have seen only positives RE earnings.
Things should improve further when I get a HTTP 2 capable server with faster page loads over HTTPS

Things should improve further when I get a HTTP 2 capable server with faster page loads over HTTPS

Yes, it should be a measurable speed increase.

Too bad so many servers don't support HTTP/2 yet. Most shared hosting doesn't. However, I predict as these machines get upgraded/replaced, support for the new protocol should spread rather quickly.

I just migrated to https a few days ago and earnings remained the same. I did update GWM etc and used Let's Encrypt for free. The Secure green notice in the URL bar looks great.

@robzilla, you are misinformed. Those Not Secure and Red warnings are only for HTTP pages that take passwords or credit card information.

Yes, Google has discussed the idea of making every HTTP page get a red "not secure" warning in the future, but they said that direction is not likely to happen until next year at the earliest and maybe even longer than that.

Once they actually announced a plan to do that, then I will migrate the entire site to https - which won't be a big hassle.

When I switched my site to HTPS (I am a small player compared to you all, I only have one site, since 15 years), it just added 50ms to the first request, additional requests have like 5ms extra added, at most. So it's really insignificant. It added only 2% of CPU load. So clearly, there is no reason to worry about all of this.

*dedicated server with intel cpu, so using AES with the hardware, and nginx web server software.

Anyone have a good suggestion for reading about the steps required to convert to https? Any reason not to start changing over?

FarmBoy

This for example : [support.google.com...]

And I see no reason not to switch to HTTPS

Those Not Secure and Red warnings are only for HTTP pages that take passwords or credit card information.

No... that phase has passed.

All pages now require HTTPS, otherwise browsers show the warning.

@keyplyr, what warning? Is there any proof of this.

I just interacted with my adsense contact and one of the mods on Google's webmaster central, and both are saying that is simply not true. They both said there is a mandatory push for any http page that accepts passwords or credit card inputs, to have https. EVENTUALLY, there will be a push for ALL http pages, but they are NOT doing that right now.

I have the Beta editions of both Chrome, Chrome Canary and Firefox and those warnings are not there for normal https pages. I just went to TMZ and Ebay - both http, and neither have any warnings.

The warning is only for pages where Chrome / Firefox, detects login form (I don't know exactly how they identify a login form, and if it can cause false-positive).

i'm not seeing that where i am either (UK). i'm using an up-to-date version of chrome, and visited a login page on my site which has a name and password field, and there are no warnings at all.
all i get in the address bar is a little 'i' inside a white circle. there are no red warnings.

just tried it with latest version of firefox as well -- no warnings on that either

what warning? Is there any proof of this.

Yes... you need to get out more :)

Test your site with some of the 10 most common used browsers. This is how your visitors are seeing your pages. They ALL give some version of a warning that your page is not secure.

a little 'i' inside a white circle.

That's a warning :) Click on it and it will warn your visitors your page is not safe.

just tried it with latest version of firefox as well -- no warnings on that either

That gray unlocked lock icon is a warning :) Click on it and it will warn your visitors your page is not safe.

Soon these warnings will get more severe.

@keyplr

I did something even better. before I switched from HTTP to HTTPS on our forum, which is very busy with 16.5 million posts and over 212,000 registered members - I was tracking the bounce rate among people using the latest edition of Chrome (with the clear as day "Not Secure" warning) and how they were interacting when landing on our forum pages.

And honestly, to my surprise, my bounce rate was 17% with that version of Chrome! I actually had a higher bounce rate with Chrome 55, which was 21%.

People are not getting scared off, likely because they are seeing that Not Secure warning on half of the sites on the net and by now know exactly what it means or they dont pay attention to the address bar.

The entire Not Secure and Secure warnings are a joke!

A very experienced developer, who is in favor of HTTPS, wrote a great article stating that it's very stupid what Google is doing. They are trying to brainwash people to think - green lock = safe website and red lock or not secure label = bad website.

So someone can go on a hacked website, which has a green lock, enter their credit card info and get robbed. But they will think it was safe because Google is brainwashing people to think a green lock means safe site.

This is why a lot of web developers are against this move because it makes it a lot harder to spot hacked websites or phising sites for the normal user.

And when the person gets robbed, who is at fault for legal damages? The site in question? Google?

vegasrick - I hear your pain :) I didn't like the extra work of switching to HTTPS either.

However, the web is changing. Your web page may soon be omitted from indexes if not secure.

Also, as noted from a couple people, HTTP/2 which greatly increases speed, only runs on HTTPS.

Bottom line... you may be left behind.

@keyplr

There isn't much extra work. For my forum we did one week of testing. Did the settings and that was that. I have 1 million pages indexed in Google from my forum so not really worried about not being indexed.

I still see websites with no mobile version come up in Google searches on mobile in decent positions.

The web is not changing. Google is dictating everyone what to do.

The same with AMP - but despite the propaganda they are pushing I know tons of publishers who dropped AMP after deep revenue hits and you only have to look at their Google News support boards to see how many Google News users (not be confused with publishers) are dropping Google News and switching to Bing News because they are sick of the AMP formats and Google News being swamped with AMP pieces, and there are thousands of complaints of AMP URLs that Google overtakes. That trend of users dropping Google News will likely continue until Google introduces an option where a reader can choose to filter out AMP links from Google News, but likely not to happen.

This is not about your side of the argument and how many good reasons you have *not* to have a secure web site. That really doesn't matter.

The web has changed to HTTPS whether we like it or not. Change with it or risk becoming irrelevant.

>> The web is not changing. <<

I've been developing web sites since 1995 (that's how old I am!) and I can tell how much the web changed, of-course, but also how much it's changing more and more faster.

Now about HTTPS (and login information), it's not about a fashion. Login information can be intercepted at any level of the web, and considering that people trend to use the same passwords everywhere else*, you can imagine the consequences. I never understood sites which had login system, which were not HTTPS. When I switched my site last year, it's because I was adding a forum.

*teaching users not to use the same password everywhere is another question.

This might be a rookie question, if it is, call me a rookie.

If I am not collecting anyone's personal data, like a credit card number for example, is using https / SSL necessary?

I may send them to XYZ company's site to buy a widget and get paid a small commission later by XYZ, but that's between XYZ and the customer - right?


FarmBoy (potential Rookie)

If I am not collecting anyone's personal data, like a credit card number for example, is using https / SSL necessary?

No, not in my opinion... but that's not the issue. The web has changed to SSL for ALL web pages whether we like it or not.

Browsers are still transitioning but the warnings will get more explicit on ALL pages.

Just get it done. It's not as much work as you may think.

OK, here's a rookie question.

News these days is full of reports of hacking, cyber attacks, customer data from millions stolen from big company 1 and big company 2, etc, etc. Will this change to SSL make a needed change to a more secure Internet experience?


FarmBoy (I wonder if rookies still have to carry the water bucket?)