April 3, 2019 0

What is Always on SSL (AOSSL) and Why Do All Websites Need It?

in Encryption, Web Security

(20 votes, average: 4.60 out of 5)

Loading...

Everything You Need to Know About Always on SSL/HTTPS Everywhere/ SSL Everywhere

It is safe to assume that you have landed on this article because you have already decided to install an SSL certificate on your website but not sure whether you need Always-on SSL (AOSSL). Well, you have arrived on the right page at the right time!

When your entire website is on HTTPS, it is called ‘Always-on SSL’ (AOSSL) or ‘SSL everywhere or HTTPS Everywhere.’

Entire website means all the webpages of your website, including sub-domains and Multi-domains. (Always-On SSL, AOSSL, SSL everywhere and HTTPS everywhere are the same things).

Some people are following an unpopular (and illogical) trend. For some reason, they keep some pages on HTTP and some pages on HTTPS for the same website. In simple words, they intentionally choose to encrypt only some webpages with SSL, while keeping others unsecured.

“so why do people not follow Always-on SSL and more importantly, do I need to practice AOSSL?”

If you have same question in your mind, you are not alone! Let’s dig into the topic and find out a sensible answer for the above question.

Popular Misconceptions about Always-on SSL

Some misconceptions and rumors have haunted the entire SSL certificate industry for a long time!

For example, some people think that HTTPS adversely affects page loading speed. However, sufficient research has now been done that proves that a website on HTTPS loads faster than the one on HTTP when they are enabling HTTP2. HTTP2 is a newer, faster protocol and it works only for HTTPS enabled pages.

Another misconception about SSL certificate is that it interferes with browser caching. This would be a problem, because allowing your users’ web browsers to cache (save locally) certain website files such as images and CSS stylesheets helps your website load faster. The good news is that browser caching works just as well on HTTPS as it does on HTTP. So, you can go ahead and switch your site to HTTPS without worrying about browser caching.

There is one more misconception popular among organizations: that they have to buy additional hardware in their IT infrastructure to force AOSSL. However, when Google implemented Always-On SSL, after extensive tests, their researchers concluded that even their high-volume site did not need additional hardware.

What extra technical steps do I need to follow to use Always-on SSL?

AOSSL technical setup is very simple. In most cases, when you install an SSL certificate, your website will load over HTTP and/or HTTPS. You usually need to make one small change to force redirects to HTTPS. For example, manually set up 301 redirects in htaccess or change settings in WordPress. Otherwise visitors can choose whether to visit your site on HTTP or HTTPS. However, these steps are easy and quick to follow.

Key Benefits of following HTTPS everywhere.

• When some pages of your website are not secured by an SSL certificate, these pages become vulnerable. There are many ways hackers can attack those insecure pages to insert malicious scripts and weaken the overall security of your website.
• Moreover, it is easy for hackers to track all the user movements from encrypted page to unencrypted page. Tracking user movements is not possible by a third party if all the webpages are encrypted. It’s like putting a strong lock on one door of your home and keeping the other door open. How hard would it be for a thief to track your movements and break into your home? Exactly! So, following HTTPS everywhere means making your entire website security stronger. It is like putting strong locks on all the doors of your home.
• All the browsers favor HTTPS pages. If your website is showing ‘not secure’ sign for some pages, your hard-earned website traffic might abandon the session thinking that your entire website is insecure. For example, if you have secured your checkout page but not product page, a customer might not even reach the checkout page and abandon your website on the products’ page when s/he sees that ‘not secure’ sign in the address bar. So, to retain customers’ faith, all pages must be on HTTPS and show a padlock sign.
• When your users bounce between HTTPS and HTTP pages, it gives extra burden to your server. Because every time a new handshake is made between browser and server when someone visits an HTTPS page. For smooth operations, all pages must be on HTTPS.
• Google gives a higher rank to encrypted websites. When some pages of your website are not on HTTPS, your overall rank gets affected. To boost your SEO efforts, you must follow AOSSL.

How much does it cost to follow AOSSL?

Some people think that they have to pay extra to follow SSL everywhere best practice. In reality, the cost of any SSL certificate by default covers the costs for AOSSL. You do NOT need to pay extra to follow Always-on SSL best practice. All the web pages for a single domain will automatically be enabled on HTTPS:// even if you buy the simplest and cheapest SSL certificate like PositiveSSL for $8.61/year. It’s like paying for an entire pizza and eating only half of it to save money! Excuse me, but you have already paid for the entire thing. So throwing the half pizza in the garbage might save some calories but it is not going to save your money! Now you know why we have used the word ‘illogical’ in the first paragraph!

The cost for securing sub-domains and multi-domains is not that much higher than securing a single domain. A multi-domain SSL certificate starts from $23/year, and a wildcard SSL certificate starts from $85.66/year. Hopefully now you can understand how not following AOSSL even for your subdomains and multi-domains can be a dangerous mistake. Following AOSSL will ultimately reward your website with smooth server operations, higher customer trust, better search engine ranking, and overall robust security assurance.

Conclusion

These are the reasons for following Always-on SSL (AOSSL).

• AOSSL technical setup is very simple.
• No additional costs are involved.
• Gain customer trust and reduce bounce rate.
• Save your server from getting an extra load.
• The entire website will be covered under SSL warranty.
• Overall website security becomes stronger — a holistic security approach.
• Improve overall website rankings and SEO efforts.