![How To Switch to HTTPS for secure WordPress forms]()
Learn what HTTP, HTTPS, SSL, and TLS are. Then we'll show you how to switch to HTTPS for secure WordPress forms.
What is HTTP?
When any two systems communicate, they need to have rules they both understand and follow so they can communicate back and forth. Much like sending paper letters back and forth using a mail service, computer systems talk to each other by sending electronic messages back and forth across networks. When sending a package to a friend—as long as you follow the rules—you trust that the package will get to the right person at the specified place. The “protocol” or rules for mailing a package to a friend might look something like this:
- Put your gift in a box
- Pay postage in the form of stamps on the box
- Make sure to include a name and address on the box so the delivery service knows where to deliver it
- Put the box in a mailbox where it will be picked up for delivery
Hyper Text Transfer Protocol, commonly referred to simply as HTTP, is the protocol used by many computer systems to "talk" to each other. Importantly, it is what your browser uses to communicate with the servers that host the websites you visit. As essential as it is, however, it does have a weakness: security.
Introducing HTTPS
Even if you followed the correct mailing protocol to send your package to a friend, you might worry about a shady neighbor shuffling through your mail. Similarly, when data is being transmitted through a large network (such as the internet), it can be problematic if the data being sent is sensitive.
Since messages using HTTP can be read by any system that also uses HTTP and has access to the same network, there is a risk that messages can be read by others.
Thus, the need for HTTPS.
HTTPS, or HTTP-Secure, is really the same old HTTP that we have been using, but it's encrypted. If HTTP is like using a delivery van to deliver a gift in a cardboard box to a friend, HTTPS is like delivering that gift inside a locked safe in an armored truck. Instead of steel and locks, however, HTTPS uses sophisticated mathematics. What’s more, with HTTPS, only you and your friend have keys to the armored truck.
Just like a delivery service is only concerned with delivery of a package and not what you do with it after it arrives, nether HTTP or HTTPS affect the data before it is sent, or after it arrives. They are simply a means of delivery. So, while HTTPS is great for sending and receiving data, it doesn’t encrypt data stored on a browser, or on a website’s server.
![How To Switch to HTTPS for secure WordPress forms]()
What is the difference between SSL, TLS, and HTTPS?
Remember earlier when we defined HTTPS as HTTP-Secure? This is because the “package to a friend” is still delivered using HTTP either way. It’s just how you package it that is different. The difference is that with HTTP your package is transported in a cardboard box via delivery van, and with HTTPS your package is placed in a locked safe inside an armored truck for its journey.
Think of Secure Socket Layer, or SSL and Transport Layer Security, or TLS, as the protocol for the encryption, or the “strength” of the safe and the armored truck you mail your package in. To summarize:
- HTTP: Like packing your gift in a cardboard box and transporting it in a delivery van
- SSL/TLS: A mathematical box safe and an armored truck
- HTTPS: Delivering the same gift, but in an SSL truck and safe
From a more technical standpoint, SSL is an older method for handling encrypted traffic. It is no longer considered safe for secure data transmission. We now use TLS, a more advanced method.
Despite the fact that they are different, the term SSL is often used (knowingly or not), when referring to TLS. Generally speaking, whether you see SSL, TLS, or HTTPS, they reference the same thing: encrypting data for transmission with TLS.
If I’m not transmitting sensitive data, why does HTTPS matter?
During its first twenty years, adoption of HTTPS was slow. It was only used when necessary because it involved additional costs and technical understanding to implement. Two independent sources show that HTTPS adoption doubled between August of 2015 and July 2016.
There are several things that have contributed to increased adoption recently.
Google Search will rank for HTTPS
First, Google announced in 2014 that its search algorithm would begin to take into account whether a site was using HTTPS in its ranking results. This provided an incentive for sites to use HTTPS for the potential search rank boost, even if they weren't necessarily dealing with particularly sensitive data.
Cost for TLS has gone down
Second, lower-cost or even free certificates have become available. In order for HTTPS to work, a cryptographic certificate must be generated by a trusted authority, installed on a server, and regularly renewed (usually once a year, but sometimes with longer terms). These digital certificates cost money, which is often a deterrent for sites that aren’t generating much, if any, direct revenue.
Let's Encrypt was created as a solution to this problem and provides free certificates. This has lowered the cost to maintain a site on HTTPS by removing what can be the biggest cost involved.
Many CDNs (Content Delivery Networks) include TLS automatically, as do many hosting providers, such as WordPress.com.
The Network and Social Effect
Third, there is a combined network and social effect. Site owners are influenced by their competitors’ adoptions of HTTPS. Site owners are also influenced by their visitors' preferences. Web users are learning that HTTPS sites are more secure, therefore more worthy of their trust. Site owners are taking this into account when looking to generate credibility.
Google Chrome will penalize HTTP sites beginning January 2017
Finally, beginning January 2017, Google’s Chrome browser will start to explicitly label HTTP sites as “not secure.” Data containing email addresses, passwords and credit card information is all considered sensitive. If your site collects sensitive information, even just from a login form, you will want to have HTTPS enabled to avoid being explicitly labeled as "not secure" in users’ browser address bars.
How to switch to HTTPS for secure WordPress forms?
WordPress itself is written to accommodate sites that use both HTTP and HTTPS. Fortunately, making the switch from HTTP to HTTPS is not generally complicated. Even though each site’s host, theme, plugins and custom code are going to be different, the process itself is pretty much the same across the board.
It may get more complex if you have additional modifications to your site behavior in your .htaccess, php.ini, Nginx config file, etc.
Without such additional site modifications, these are the steps you’ll want to follow to ensure a clean switch:
Step One: Contact your Host
In order to transition to HTTPS, you will need a Dedicated IP Address and an SSL certificate. Individual setups will vary, but your host will be able to provide guidance on how to best transition given your setup as far as the server is concerned.
Most hosts will offer SSL certificates (for free or for purchase) and many hosts will even install it for you for a fee. You can get one for free through Let’s Encrypt, but it will require a bit more technical understanding to set up. It may be worth it to purchase your SSL certificate through your hosting provider to have installation performed by their staff.
If your host will not be installing your SSL certificate or you simply choose to install your own SSL certificate, do your research, and continue to step two.
Essential reading before implementing your own HTTP to HTTPS switch
Google’s Protect your site and your users
Google’s Move a site with URL changes (HTTP to HTTPS requires a URL change)
SSL Labs SSL/TLS Deployment Best Practices (for more advanced reading)
Step Two: Make a complete backup of your site
Backup plugins are convenient, but should your site become inaccessible during the process and you aren't able to access the Dashboard, rolling back changes can become more problematic. For backups, I always feel better after making a complete copy of the WordPress home directory, exporting a complete copy of the database, and saving both on my laptop (off of the server). I'll admit it is a bit extreme, but it's the safest approach.
Step Three: Updating WordPress Settings
- From the Dashboard, go to Settings > General. Change your WordPress Address (URL) and Site Address (URL) from http to https.
- Open your wp-config.php file. Just above the line that reads: That's all, stop editing! insert this line: define('FORCE_SSL_ADMIN', true);
- Go to Settings > Permalinks. Click Save Changes.
- Insert a 301 redirect so that any traffic coming to your site over HTTP will be redirected to the HTTPS version. There are plugins that can handle this for you. For the more technically inclined, this can be done by modifying your site’s .htaccess, php.ini, or Nginx config file, as applicable.On FormidablePro.com, we added this to the beginning of our .htaccess to force all pages to use HTTPS:
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule ^(.*)$ https://formidablepro.com/$1 [R=301,L]
</IfModule>
What do I need to do for Formidable to work on HTTPS?
Here's the good news: You don't have to change anything in your Formidable settings for your forms to work over HTTPS. As long as your WordPress site changeover has been properly made, any data transmitted to and from your site will be secure. Please note that HTTPS will secure data in transit, but it does NOT add an extra security layer to stored data.
What if my transition to HTTPS doesn’t go well?
Here are a few troubleshooting tips:
- Instead of simply re-saving your permalinks in Settings > Permalinks, try changing the permalink structure to Plain, saving, and then changing them back to your desired structure.
- Do you have any custom code that references the HTTP address for the site that will need to be adjusted to HTTPS?
- If you replace the default WordPress index.php with one that just says “hello”, do you see any errors, or do you see the HTTPS padlock in the address bar? If the padlock doesn’t appear, is likely the trouble is with the actual the SSL setup, and not your code.
- Do you have any server-side or CDN-based caching in place? If so, these may need to be flushed or have their settings updated to work with your new setup.
- Sometimes certain interactions between plugins and themes can make the transition more complicated and more likely to generate unexpected errors. Should this be the case, try changing your theme to Twenty Sixteen (or another WordPress default theme), deactivating your plugins, making the switch, and then re-activating your plugins and switching back your theme.
How will my search rankings be affected by the switch from HTTP to HTTPS?
Google’s Change of Address Tool for webmasters does not yet support the HTTP to HTTPS transition. This can negatively affect your search rankings temporarily because your site will need to be re-crawled and reindexed. While Google states that you may not see an obvious change in your rankings, there is debate around the web about whether the switch has a negative or positive effect.
The upcoming changes in January could have a bigger impact on the trust your visitors place in your site, which could in turn reduce your traffic and your rankings.
When it was originally announced that Google would be taking HTTPS into account for rankings, they made it clear that this would not affect everyone. In fact, it was reported that this update would initially affect less than 1% of searches, but its impact may grow. Since then, the push for an encrypted internet has grown from within the industry, but also from without, as internet users become more concerned about leaked information, traffic snooping, and their online safety in general.
Switch to HTTPS for secure WordPress forms
The future of the internet lies within secure, encrypted transmission. For WordPress websites, that means HTTPS. Fortunately, transitioning your site to HTTPS is easier and cheaper than it has ever been. In addition to the SEO and user trust benefits, switching is something that requires little time, no backlinks, no marketing strategy meetings, and no artwork with cool fonts (though we are huge fans of cool fonts). Switching to HTTPS is something a site owner can check off the list and only have to think about once a year. Get it done. A safe internet will thank you for it.
The post How To Switch to HTTPS for Secure WordPress Forms appeared first on Formidable Forms.