4 ms·

I work at Google in web search. It's great to see another example of a site indexed under HTTPS as it's a common question we see. Sadly, for such an important t

I work at Google in web search. It's great to see another example of a site indexed under HTTPS as it's a common question we see. Sadly, for such an important topic, there are many myths. I didn't dig into this particular example, so a couple of things about the topic of this post: 1. As much as I'd personally would love to see it happen, we currently don't give any ranking boost or demotion based on whether the site is HTTPS or HTTP. Regardless, it's a good thing to do for your users anyway, so please do it if you can. 2. Fellow Googler Ilya Grigorik, who's also on HN, and myself gave a talk about HTTPS two weeks ago at I/O. We covered a lot of topics about how to deploy HTTPS in a secure and fast way, and also how to get Google's indexing algos favor the secure site. It's here: http://www.youtube.com/watch?v=cBhZ6S0PFCY http://www.youtube.com/watch?v=cBhZ6S0PFCY Happy to answer any questions here.

tkinom 12y ago
google can easily help spread https more by offering: * free ssl cerf. * free/low cost https proxy / caching proxy for small websites.
- tkinom 12y ago
  especially for mobile app websites.
tootie 12y ago
I had this debate on my last project: Does Google consider http and https on the same host to be separate sites? Assuming http://www.example.com/home http://www.example.com/home and https://www.example.com/home https://www.example.com/home return the same content, are they considered one page or two?
- deleted 12y ago
  [deleted]
- pierrefar 12y ago
  Hi tootie These are two sites. In reality, most secure sites have four variants: http://www.example.com http://www.example.com http://example.com http://example.com https://www.example.com https://www.example.com https://example.com https://example.com You should watch the I/O video about what to do here for optimal indexing. Briefly, redirect all variants to just the one, but there is a lot more you need to watch out for. It's all in the video.
  - tootie 12y ago
    But why?
gmisra 12y ago
Are you in a position to request that these two videos are removed from the privileged access section of the GV Library? Definitely the top two videos I wanted to watch from there, and it seems like better security practices is a win for everybody. * http://www.gv.com/lib/security-for-startups http://www.gv.com/lib/security-for-startups * http://www.gv.com/lib/advanced-security-for-startups http://www.gv.com/lib/advanced-security-for-startups
return0 12y ago
So we have two websites on the same server (same IP, using SNI), siteA has SSL, siteB doesn't. Google will attempt to crawl https://siteB/ https://siteB/ (which will return siteA's content! in a browser you would get a warning about the certificate being wrong). Since there are no links anywhere that point to https://siteB https://siteB why does google crawl it? This is technically a configuration / apache error, but google should not be crawling https websites when their domain does not match the certificate.
- pierrefar 12y ago
  Hi return0 This means that at some point Googlebot discovered https://siteB https://siteB. It could simply have been a misconfigured CMS, or a bad sitemap, or an errant link one of your visitors shared on a forum, or something a previous owner of the domain did, or anything really. You may think there are no links to the site, and that may be true right now, but it's about something that Googlebot found in the past. The correct fix is, as you say, to make sure the server doesn't respond to invalid certificate+site combinations.
kysol 12y ago
The scary thing is that I started writing an article about this on the 28th, all due to a comment I was sent by an advertising agency stating that "HTTPS is only really for checkout pages". I nicely pointed out why they were wrong. It was mentioned somewhere that if Google started giving priority to full HTTPS sites, there would be a mass scramble to convert web sites to support HTTPS. Isn't this what we want? You can warn people all you like, but until it starts to hurt them, they won't listen.

tkinom 12y ago

google can easily help spread https more by offering: * free ssl cerf. * free/low cost https proxy / caching proxy for small websites.

tkinom 12y ago
especially for mobile app websites.

tootie 12y ago

I had this debate on my last project: Does Google consider http and https on the same host to be separate sites? Assuming http://www.example.com/home http://www.example.com/home and https://www.example.com/home https://www.example.com/home return the same content, are they considered one page or two?

deleted 12y ago
[deleted]
pierrefar 12y ago
Hi tootie These are two sites. In reality, most secure sites have four variants: http://www.example.com http://www.example.com http://example.com http://example.com https://www.example.com https://www.example.com https://example.com https://example.com You should watch the I/O video about what to do here for optimal indexing. Briefly, redirect all variants to just the one, but there is a lot more you need to watch out for. It's all in the video.
- tootie 12y ago
  But why?

gmisra 12y ago

Are you in a position to request that these two videos are removed from the privileged access section of the GV Library? Definitely the top two videos I wanted to watch from there, and it seems like better security practices is a win for everybody. * http://www.gv.com/lib/security-for-startups http://www.gv.com/lib/security-for-startups * http://www.gv.com/lib/advanced-security-for-startups http://www.gv.com/lib/advanced-security-for-startups

return0 12y ago

So we have two websites on the same server (same IP, using SNI), siteA has SSL, siteB doesn't. Google will attempt to crawl https://siteB/ https://siteB/ (which will return siteA's content! in a browser you would get a warning about the certificate being wrong). Since there are no links anywhere that point to https://siteB https://siteB why does google crawl it? This is technically a configuration / apache error, but google should not be crawling https websites when their domain does not match the certificate.

pierrefar 12y ago
Hi return0 This means that at some point Googlebot discovered https://siteB https://siteB. It could simply have been a misconfigured CMS, or a bad sitemap, or an errant link one of your visitors shared on a forum, or something a previous owner of the domain did, or anything really. You may think there are no links to the site, and that may be true right now, but it's about something that Googlebot found in the past. The correct fix is, as you say, to make sure the server doesn't respond to invalid certificate+site combinations.

kysol 12y ago

The scary thing is that I started writing an article about this on the 28th, all due to a comment I was sent by an advertising agency stating that "HTTPS is only really for checkout pages". I nicely pointed out why they were wrong. It was mentioned somewhere that if Google started giving priority to full HTTPS sites, there would be a mass scramble to convert web sites to support HTTPS. Isn't this what we want? You can warn people all you like, but until it starts to hurt them, they won't listen.