To HTTPS or not to HTTPS?

[Vars]

I have a money site that I have had for a very long time.  It does roughly $150k per year.  Unfortunately, I am not running ssl on it and I am worried that my monetization is going to take a big hit due to Google's alarms about my site not being secure.

I am considering switching to https, but I am really worried that I might take a significant hit in my search engine rankings.  I've read about other site owners saying their rankings dropped a lot after switching or that sometimes it takes several months for their rankings to come back.

So what do you all think?  Is it worth the risk to implement ssl on my site or should I keep it as is?

[Mike Friedman]

It's really tough to start thinking about messing with a site pulling in $150k per year.

I think the "not secure" warnings are going to have bigger impacts in some spaces than others. For example, among older people, I could see them being more alarming. In niches like finance, law, and healthcare I could see it eroding some trust and hurting conversions.

And if Google ever goes to the big warning page before you even get to a site not using HTTPS, that is really going to hurt traffic.

I think the warnings are only going to become more intrusive over time. Google is getting their wish for the majority of websites to use HTTPS/SSL.

Most of the conversions I have done happened seamlessly. There were a couple that had a few hiccups for a few weeks. In my experience, the smaller the site, the less likely it is to see any kind of fluctuations as long as everything is done properly.

[Guest]

8 hours ago, Vars said:

So what do you all think?  Is it worth the risk to implement ssl on my site or should I keep it as is?

Paraphrasing what Mike said, needing SSL is becoming inevitable and it's really not just Google pushing for it anymore - I'm seeing a general push towards it everywhere.

Fortunately, there is some middle ground here, where you could try phasing in SSL. What I mean by that is that typically, we'd add SSL and then slap a global 301 redirect in htaccess or the server blocks and call it done, but it doesn't have to happen that way. 

What you can try to do is add SSL (without the global redirect) and then modify your internal linking over time, starting with pages that aren't producing or are low producers. As you do this, modify your sitemap to reflect the changes as well. Depending on the volume of pages, you can also do individual 301 redirects in htaccess or the server blocks for those pages. You should  start using SSL on any new back links you're making too. 

This gives you the best of both worlds - it leaves your non-SSL pages running normally, so SERPS won't be impacted all at once. This is more of a trial and error approach, but it moves you in the right direction without any major impact on your site overall. 

[Mike Friedman]

6 hours ago, BIG Mike said:

Paraphrasing what Mike said, needing SSL is becoming inevitable and it's really not just Google pushing for it anymore - I'm seeing a general push towards it everywhere.

Fortunately, there is some middle ground here, where you could try phasing in SSL. What I mean by that is that typically, we'd add SSL and then slap a global 301 redirect in htaccess or the server blocks and call it done, but it doesn't have to happen that way. 

What you can try to do is add SSL (without the global redirect) and then modify your internal linking over time, starting with pages that aren't producing or are low producers. As you do this, modify your sitemap to reflect the changes as well. Depending on the volume of pages, you can also do individual 301 redirects in htaccess or the server blocks for those pages. You should  start using SSL on any new back links you're making too. 

This gives you the best of both worlds - it leaves your non-SSL pages running normally, so SERPS won't be impacted all at once. This is more of a trial and error approach, but it moves you in the right direction without any major impact on your site overall. 

There is truth to that. 

On the other hand, if someone is worried about the new changes coming to Chrome chasing away traffic and hurting conversions, at this point they only have about 2 weeks before they go into effect.

[yukon]

What percentage of Google traffic actually translates into sales/conversions for OPs site?

[Vars]

1 hour ago, yukon said:

What percentage of Google traffic actually translates into sales/conversions for OPs site? 

The vast majority of the $150k per year is from Google traffic.

Thanks for all the replies and suggestions.

[yukon]

Personally, I wouldn't mess with a site structure that's making good money.

IMO, If you eventually have to take the risk, ride it out until the end and then take the risk when you don't have a choice. Right now (today) you've got a choice.

[Alistair]

Bit late maybe but I was in basically the same position about a year, 18 months ago. I have a site that doesn't make a lot of money so did that first, no negatives. Then a month or so after I did my main money earner and no negatives on that either. I followed this guide as I didn't know much about it which helped https://www.bram.us/2014/12/06/migrating-your-wordpress-website-from-http-to-https/

There is a plugin (or two probably) if it's on wordpress that does it all for you other than install the ssl certificate I think but not sure whether it's any good but has a lot of good reviews and I know it's been used by a few people on a UK forum I frequent who have moved over to https who say it was good for them. https://en-gb.wordpress.org/plugins/really-simple-ssl/

After I finished used the following site to check for any "errors", there were a few minor but they were pretty simple to fix, only took a few minutes for myself fortunately.https://www.whynopadlock.com/

[Mike Friedman]

1 hour ago, Alistair said:

Bit late maybe but I was in basically the same position about a year, 18 months ago. I have a site that doesn't make a lot of money so did that first, no negatives. Then a month or so after I did my main money earner and no negatives on that either. I followed this guide as I didn't know much about it which helped https://www.bram.us/2014/12/06/migrating-your-wordpress-website-from-http-to-https/

There is a plugin (or two probably) if it's on wordpress that does it all for you other than install the ssl certificate I think but not sure whether it's any good but has a lot of good reviews and I know it's been used by a few people on a UK forum I frequent who have moved over to https who say it was good for them. https://en-gb.wordpress.org/plugins/really-simple-ssl/

After I finished used the following site to check for any "errors", there were a few minor but they were pretty simple to fix, only took a few minutes for myself fortunately.https://www.whynopadlock.com/

I have used the Really Simple SSL plugin on a couple of sites. It works. Nothing wrong with it. Most of it is stuff that can easily be fixed manually. 

Changing to HTTPS on a Wordpress site is very easy these days.

I did a short video where I migrated a site to HTTPS in just a few minutes here.

If your host supports Let's Encrypt in cpanel, it is a breeze to do.

[Vars]

So I decided to bite the bullet and migrated a smaller money site about 2 months ago. Everything went well, so I took the plunge with my main money site 1 month ago. While I was adding SSL, I also got rid of the "www" and also changed the url for a chunk of pages to a new silo for better seo. I was/am on Amazon EC2 and was running apache/varnish/mysql and switched to nginx/php-fpm/rds. Figured if I was going to risk big changes why not go all in?

Everything went fantastic. I noticed no drop off in traffic (so far...fingers still crossed and breath still being held) and many of my SERPs (and traffic) have actually improved. On mobile I noticed a HUGE improvement in SERPs. I was on first page for like 50 keywords on mobile, now I am 1st or 2nd result for those keywords on mobile.

Anyways, just wanted to share my results in case anyone else is considering switching to HTTPS or drastic URL structure changes.

[Mike Friedman]

On 10/24/2018 at 2:06 AM, Vars said:

So I decided to bite the bullet and migrated a smaller money site about 2 months ago. Everything went well, so I took the plunge with my main money site 1 month ago. While I was adding SSL, I also got rid of the "www" and also changed the url for a chunk of pages to a new silo for better seo. I was/am on Amazon EC2 and was running apache/varnish/mysql and switched to nginx/php-fpm/rds. Figured if I was going to risk big changes why not go all in?

Everything went fantastic. I noticed no drop off in traffic (so far...fingers still crossed and breath still being held) and many of my SERPs (and traffic) have actually improved. On mobile I noticed a HUGE improvement in SERPs. I was on first page for like 50 keywords on mobile, now I am 1st or 2nd result for those keywords on mobile.

Anyways, just wanted to share my results in case anyone else is considering switching to HTTPS or drastic URL structure changes.

I would imagine the SERP improvements are much more to do with the better site structure than switching to HTTPS, but good to hear that you had a smooth transition.

It seems Google is getting better at how they handle these migrations. I'm hearing fewer stories of people switching and seeing an immediate drop in traffic.

 

 

[Wunderkind]

On 10/28/2018 at 4:38 PM, Mike Friedman said:

It seems Google is getting better at how they handle these migrations. I'm hearing fewer stories of people switching and seeing an immediate drop in traffic.

I noticed this too. I migrated two sites three weeks ago that were pretty good sized (that's what she said) and saw zero bumps.