Let's Encrypt removed the "beta" label two weeks ago. It has been issuing free certificates to the public since December, but as of April 12 it is a fully operational certificate authority that anyone can use, at no cost, with renewals that can be handled automatically.
A few days earlier, WordPress.com enabled HTTPS for every blog using a custom domain, with Let's Encrypt certificates. Millions of sites were converted at once, without any action from their owners.
For a small business owner, this may sound like a technical detail. Its significance is greater than it appears.
Why has HTTPS been treated as an add-on for small business websites?
Because it cost money and required technical effort for a modest benefit. Google announced in August 2014 that HTTPS would count as a small ranking signal. Most small sites did not switch, for understandable reasons. A certificate had to be purchased from a vendor and paid for again every year, then installed through a process that involved generating a signing request, pasting blocks of code into a control panel and hoping it worked. Some low-cost shared hosts charge an additional fee simply to allow a certificate.
HTTPS therefore remained an add-on. Banks use it. Online stores use it, at least on the checkout page. A dive centre or a guesthouse with a contact form almost never does. When the topic comes up, owners always ask the same question: what does it cost, and what does it bring? Until now, the accurate answer was "some money, some effort and a very small ranking improvement," which was not a compelling case, and we did not press the point either.
What does Let's Encrypt change?
It removes both the cost and the manual work. Let's Encrypt is operated by a non-profit, the Internet Security Research Group, with support from Mozilla, the Electronic Frontier Foundation and other organizations. Its goal is to make encryption the default. Certificates are free and valid for 90 days. The short duration is deliberate: renewal is designed to be automated, so it is configured once and a small program renews the certificate in the background.
At present, this still assumes someone is comfortable with a server command line, which is rarely the case at a small dive shop or bakery. The decisive factor will be hosting companies integrating the process into their control panels. Several already have. WordPress.com has just demonstrated that it can be done at very large scale with no effort from the site owner. The trend suggests that within a year or two, a host still charging for a basic certificate will be difficult to justify.
For background information, or for those who manage their own server, Let's Encrypt's own site explains how it works in plain language.
There is another reason to act soon. The Chrome team has stated publicly that it intends to eventually mark plain HTTP pages as not secure, without specifying a date. When that happens, the question will no longer be about SEO; it will become "why does my website say it is dangerous?" We recommend completing the switch before any customer sees such a warning.
How can a small business site move to HTTPS without breaking?
By following a set order. The sequence below works for a typical WordPress site:
- Back up the site and the database, every time. It takes five minutes.
- Install the certificate and confirm that the HTTPS version of the homepage loads.
- Change the site address in the WordPress settings from http:// to https://.
- Run a search-and-replace on the database to update old http:// links to your own domain, in posts, menus and widgets.
- Set up a permanent 301 redirect so that every HTTP address leads to the same page on HTTPS. Every page, not only the homepage.
- Crawl the site, or browse it with the browser's developer console open, and identify mixed content.
- Add the HTTPS version as a new property in Search Console, and update the address in Google Analytics, the Google My Business listing and social media profiles.
Step five is the one most often skipped. The certificate is installed, the padlock appears on the homepage, and the work stops there. The result is two copies of the site, one on HTTP and one on HTTPS, with old links and bookmarks still leading to the insecure version. Google sees duplicate content, which harms the site.
What is mixed content, and why does it cause problems?
Mixed content occurs when a page loads over HTTPS but retrieves an image, a script or a font over plain HTTP. The browser detects it. For images, the usual consequence is the loss of the green padlock, which looks careless. For scripts, the consequence is more serious: browsers block them entirely, which can break a slider or prevent a booking widget from loading, without any notification. Bookings simply stop.
On small sites, the usual sources are always the same:
- images inserted into older posts with the full http:// address
- a theme with a hard-coded link to a font or a script
- an embedded map or booking form from a third party that has not yet switched
- a footer logo uploaded years ago
The solution is methodical: find each one and correct it. The browser console lists them. We prefer to spend an hour on this before confirming to a client that the site is on HTTPS, rather than receive a message three days later about a booking form that has stopped working.
One further point concerns third parties. If a booking engine or payment page is not yet on HTTPS, the provider should be asked firmly when it will be. The correction is the provider's responsibility, but it is the business's own site that appears unreliable.
Is it worth switching now?
Yes. For a new site, there is no longer any reason to launch on plain HTTP. For an existing small site, we recommend planning an afternoon, choosing a quiet day, and monitoring Search Console for a couple of weeks afterwards. Traffic may fluctuate slightly while Google processes the new addresses, and it then stabilizes.
It is also essential to confirm that renewal actually works. A 90-day certificate that is not renewed produces a full-page browser warning in front of customers, which is among the worst first impressions a website can make. This kind of recurring task belongs in regular site maintenance, and it is worth asking any web hosting company directly whether it handles renewal.
For a long time, encryption has been treated as a feature to sell, when it should have been the minimum standard. Let's Encrypt may finally make it the standard for every site, not only for those that could afford it.