In this video you'll learn about the advantages and benefits of serving a Web site to visitors through
a secure connection using HDTV apps and SSL certificates.
You'll be setting up a secure web site using free tools within your site.
Ground student hosting account e-commerce sites aren't the only websites that should be encrypted while
communicating with visitors through the browser.
These days there's no reason why every Web site shouldn't be delivered over the HTP s secure protocol
by adding the secure sockets layer to your web sites.
Your sites will build trust with web site visitors.
Speed up loading secure any data sent in contact form sign ups and e-commerce fields and get a nice
advantage with the search engines offering this as part of your business is a no brainer.
When there's a free solution that's easy to use.
Let's check it out.
First let's learn about HTP versus HTP.
S for a few minutes before we start setting up our secure Web site.
Here's an interesting page at HTP versus h TTP s dot com.
It illustrates what I think is one of the most important benefits to switching to a secure connection
for delivering Web sites.
Which is it makes your website load so much faster.
This interesting web page shows that on its secure page where it's got the green padlock symbol over
here and you can open up and get some information that the domain that it's using has been verified
by a third party and any data going back and forth between the server and the user was encrypted before
being transmitted over the Internet.
So not only does this build trust with your web site visitors but it also enables a Web site to use
what's called the H TTP to protocol instead of HTP 1.1 which was last updated in 1999.
All modern browsers allow for HTP to to be used but using the secure h TTP S is a requirement.
This little web site page shows us how h t t p s and HDTV too can be so much faster than HTP itself
which is also unsecure.
So if you start out by just clicking HTP here or opening up the page fresh your browser will record
how long it takes to load all of the data from this web page and it says it took eight and a half seconds.
Now if I just click HTP s we can see that this loads in 1.7 seconds.
Now you may not have noticed.
But back in the web site that is live on the internet that I've been working on in this course is that
Greg Davis dot com slash MailChimp.
It's where we built the newcomers store and the MailChimp integrations but at Greg Davis dot com I have
an H T T P S protocol here.
The green padlock shows and you can see that Greg Dave is dumb as a domain name has been verified by
a third party called Let's encrypt.
And if I had more information you can see that all the data has been encrypted before being transmitted.
So anyone viewing my connection say if I was in a coffee shop or anything like that I cannot see any
of the information traveling back and forth in both directions between the server and the user with
their browser open.
You can see if I scroll back to the original Gray Davis com WP admin options page here.
My settings generally shows that I'm using the Wordpress address with the h t t p s and the site address
as the same HTP as to force the website to open using that secure protocol.
Once I have a certificate installed and verified at the server I can also make one more add it to a
hidden H.T. access file at the server.
Adding a few lines so that if anyone goes to any page of my website without typing h t t p s.
If I type HTP colon slash last Greg Davis dot com when I open that web page the browser goes directly
to the secure version and doesn't allow the insecure version to be opened.
Let's encrypt is a new certificate authority that can verify the domain and the ownership and organization
behind your web site and allow you to use the HTP protocol for free though it gets pretty complicated
pretty fast.
Luckily a lot of the best Web site hosts are now implementing a clickable utility inside the C panel
or inside of their server areas that allows you to set up a let's encrypt HTP as certificate quickly
and easily.
So what other reasons are there for using this security TTP as connection for serving your Web site
to visitors.
Well another big reason is that in the last couple of years Google has made HTP as a ranking signal
meaning that they are going to look at secure web sites and give them higher rankings than web sites
that aren't delivered securely.
Google also rewards the speed of loading of a Web site too with higher rankings and if you read some
of the articles on the Internet you can find that there are some more obvious reasons to use secure
TTP as the most obvious one is if your site's an e-commerce site.
If you are asking your visitors to put any sensitive or private information into a form and send it
to the web server you need to be using SSL to encrypt that information as it goes across the Internet
lines.
If you use a third party payment processor you can get away with sending your visitors to a secure page
away from your web site such as PayPal and then having them put in their payment information there and
then being sent back to your non-secure site.
But why not.
If it's going to be faster it is going to get better page rankings with Google and other search engines.
Why not use HDTV for your entire website regardless of whether you're taking payments directly or not.
Do you have a log in form.
Well of course we as Wordpress users all have log in forms to log into our WordPress dashboards and
somebody who is hacking and looking at the traffic of your Web site say at a coffee shop with a public
Wi-Fi connection would be able to see or log in and your password and potentially do something bad with
it.
And finally if you have any kind of form on your website when you ask users to fill out a contact form
or a log in form if they're becoming members of a Web site you'll want to encrypt that information like
their usernames passwords or any information they might be sending to the Web site's server so that
it's secure and can't be read while it's on its way.
Now that I've convinced you of the need to make all your web sites SSL supported and secure at h t t
p s.
Let's just quickly look at the different types of SSL certificates.
There's three different types and the one you often see with the name of the business in green in the
address bar is the most expensive and is the extended validation SSL certificate.
The certificate authority that's providing the certificate here does a thorough vetting of the organization
and it's the only type of SSL certificate that puts the name of the business in the address bar the
second level is an organization validation which really looks the same as the third domain validation.
But it doesn't have the name up here but it does have the green padlock.
All three of these send data over the Internet in a secure and encrypted fashion.
But the organization validation is a little less expensive and there's certificate authority conducts
some vetting of the organization.
The most versatile and the least expensive is the domain validation SSL certificate where the certificate
authority checks the right of the applicant to use a specific domain name.
There's no company or identity information that is vetted and certified.
But it goes all the way down to zero dollars to get a domain validation SSL certificate.
Now if you go to a number of different certificate authorities go daddy is one.
If you look at the certificate types here the standard one which has a domain validation they actually
charge almost $70 a year to do that.
And the ii-V or the extended validation costs two hundred dollars a year and a lot of the big certificate
issuers are still in this old paradigm of charging some amount under $100 per year for a domain verification
and then charging about $200 a year for the extended validation rapid SSL is another recommended one
from G.O. trust their domain is $69.
And if you go down and open up you know they're G.O. trust extended validation.
You're looking at $300 a year for that flywheel being a managed WordPress host.
Once they get in there and help you manage and set up your security certificates personally it's a great
service and for building a client web site for an e-commerce store that was going to take credit cards
or someone that needed an extended validation certificate.
I would set up their site at flywheel where they would be able to manage my certificate.
It's renewals and it's set up in the back end for me.
There was a couple of security help articles at flywheel and they give you a couple of steps.
They do charge you $10 a month to manage your SSL certificate on your host but it's worth doing if you're
buying an extended validation certificate so you purchase the SSL add on from fly wheel for $10 a month
per website and then once you buy your SSL certificate from Go Daddy or another provider you will get
a zip file that you need to send to flywheel and then they'll set up your Web site posting under HTP
s they don't offer SSL certificates themselves and that's why you have to buy one from a third party
and then you can have them force SSL on your site just the same way that we're going to be doing with
the free let's encrypt certificates at site ground here in a minute.
Let's encrypt in contrast is an open source free and automated certificate authority.
It works equally as well.
It encrypts data equally as well.
It makes your Web site just as fast and lets it use HTP too.
And it's absolutely free.
It's just now starting to get hosting companies to install utilities that lead easy for users like you
and me to get it working.
Let's get started with it.
Now I've got a new WordPress installation at my site Ground student edu does site account and here's
my domain name.
It's Greg Deedat s g edu dot site.
So if you have a site set up already you can go ahead and encrypt that site.
You can set up a different one if you've expanded your site ground to use more than one domain or on
another server that you already own.
I'm going to go over to the admin panel which is my wordpress dashboard log in and you can see that
this is not being served under a secure connection.
It's just a regular HTP site.
And if I log in.
It'll open up the Wordpress dashboard.
And I'm also going to open up the site itself in another tab so that I can see the results of my work.
You can see them on a regular HTP site non-secure so follow along with me inside of your Wordpress installation
and your server space in the C panel.
I'm going to open up the see panel in my site Ground account and the first thing I'm going to do is
just go down and I'm going to go down to the security area right down here and click let's encrypt.
Go ahead and pause the video wherever you need to and follow along and do the same thing.
So I've just got the one domain right here.
I'm going to use a testing e-mail address that I have right here which is my admin e-mail.
Anyway here at my testing site Ground account and I'll just click install.
Now if you follow along with some of the report you'll get here in the above the progress bar.
It's pretty interesting.
I'll pause the video now and let that finish.
All right after just a few seconds I got a success message here.
Let's encrypt certificate installation success.
And if you followed those progress bar messages you could see all those little steps that the server
was taking to insert the certificate signing requests and to respond and to open the HTP connection.
All those things are things you would have had to do manually if site Ground hadn't installed this utility.
So now that I hit OK I can see that I've got an installed certificate for this domain name.
It's active and it has a renewal date and this is something to note but doesn't give us any extra work.
Let's encrypt certificate authority issues certificates that expire every three months and so on some
servers they require you to go in and renew the certificate manually every three months.
Whereas here at site ground it's got an automatic renewal going on inside of the server so we won't
have to do anything else with the certificate.
Again now back at the Wordpress dashboard there's a change we need to make in the settings under general
and just because I installed the let's encrypt certificate on my server under this domain that doesn't
mean that every time anyone goes to the Web site they will be automatically redirected to the secure
Web site.
In fact if I refresh the page here you can see that it easily opens the non-secure version of my website
right here.
We need to do two more quick changes to force all visitors to the Web site to be redirected to the secure
and encrypted version.
So I'll go back into that general settings and I'm just going to add the s right after TTP and wordpress
address and site address and all I'm doing here is I'm defining the HDTV as protocol inside the database
for my wordpress dashboard and my web site click save changes there at the bottom.
And when you do that it will force you to go ahead and log back in again.
But that's really all I have to do.
Back at the Wordpress dashboard the next thing I have to do is add a specific little three lines of
code inside of the C panel and the file manager.
I'm just going to go to the file manager a little bit lower under files I'm going to click File Manager
and I want to make sure that this box is checked right here.
Show Hidden Files.
The file that we're going to edit is the H.T. access file which actually starts with a dot dot H.T.
access.
And that file is a hidden file.
Data Files are hidden files but if we can use this file manager to not only look at and download and
upload files but to edit them as well inside of the subpanel utility here inside of site ground.
So I click the H.T. access the one that's inside my public underscore HTL mail folder.
That's right where my wordpress installation files are.
And I'm going to go up and click code editor.
Now I can just hit edit and it opens up the content of this HD access file what I'm going to be doing
is placing a few lines of code above the word Press.
Rewrite rules that are automatically in there from WordPress.
Now I've opened up a text file that I provided to you in the Resources page of the students that WP
of course does com Web site as well as in the resources page after this chapter inside of the course
web site.
This code gives us a 3 rewrite rules that we want to add to our H.T. access file and then edit the Web
site you are able to our own.
I'm going to hit copy control C and then we go over to the HD access files put the cursor there and
hit the control V to paste those three lines in here.
What this does is you can see that it forces the browser when they go to this Web site to be redirected
if they're not already to the HTP s version of the Web site.
And you can find these lines of code if you do a little bit of research on your own on H.T. access rules
for SSL or for secure web sites.
So paste that in there and then put your own web site you Arel in here instead of the example your Web
site dot com where I'm going to get that is just over at my web site address here I can just grab the
text instead of here and hit copy control-C.
And now I'm going to go back into that file editor and I'm going to control and I'm going to select
everything inside the slashes there and hit Control V and just make sure that that's right no extra
spaces or anything.
That's correct.
OK then I can hit save in my HD access file I can close that window now when I go back into the Wordpress
dashboard.
And I was already on the secure version of the site here.
So if I refreshed the page let's just make sure everything is working.
You have that loaded great.
I go to the Web site where it's in the non-secure version in my browser and I just hit refresh and I'm
got the green padlock.
Excellent.
A secure connection.
I open it up.
It's verified by let's encrypt can go to more information and I could see that the page was encrypted
before being transmitted over the Internet.
In this lesson you transformed your life site at site ground into a super fast loading secure site that
automatically uses the HTP to protocol.
Now all your client sites can be 10 times faster get higher page ranking with the search engines and
transmit and receive only encrypted data to and from the server.
In this chapter we've really taken your Web site management and client offerings to another level from
managing multiple websites to updates and security hardening to the best insights speed and security
through SSL.
You're ready to bring all this to clients in the next chapter.
We'll put it all together and wrap up the course with lessons about proposals and Web site care plans
for client work billing and invoicing techniques and reviewing everything you learned in this course.
Let's do it.