HTTPS / SSL
In one sentence
Encrypted transport between the browser and the server, indicated by the padlock in the address bar.
Analogy Mental model
The security gate and the cameras at the entrance. They protect what customers bring in with them.
In practice What you actually do
A free certificate from Let's Encrypt or from the CDN is enough. Redirect all HTTP to HTTPS permanently, serve the whole site over it including images and scripts, and enable HSTS once you are certain nothing still needs plain HTTP.
Where people get burned Pitfalls
The ranking effect is small and the trust effect is not. A browser warning that the connection is not private ends the visit before the page appears, and on a checkout it ends the order.
This entry was written in English from the Chinese original, not machine-translated. Read the Chinese version →