HTTP is dead. Here’s why, and what you need to know to migrate to HTTPS. Delivered to the BigWP Meetup NYC on September 15, 2015. Detailed guide: https://docs.google.com/document/d/1EJKAoa4Hxc4AyH0znuA_AAplcNeNejEhATFptFX-OME/edit

1. Delivering the news
over HTTPS

2. Paul Schreiber@paulschreiber

6. HTTP1991–2015

7. HTTP1991–2015

12. HTTP

13. HTTPS

18. A Call to Action
If you run a news site, or any site at all, we’d like
to issue a friendly challenge to you. Make a
commitment to have your site fully on HTTPS by
the end of 2015 and pledge your support with
the hashtag #https2015.
—Eitan Konigsburg, Rajiv Pant and Elena Kvochko
“Embracing HTTPS”
November 13, 2014

19. setup

26. $
sslmate
mkconfig

27. https://mozilla.github.io/
server-­‐side-­‐tls/
ssl-­‐config-­‐generator/

28. HSTS

29. HTTPS enabled

30. HTTPS enabled
HTTPS default

31. HTTPS enabled
HTTPS default
HSTS

32. HTTPS enabled
HTTPS default
HSTS
HSTS preload

33. content

34. content

35. ads

36. analytics

37. CDNs

38. fonts

39. content
😕

41. https://github.com/
bramus/mixed-­‐content-­‐scan

42. <script
src="//google.com/…
<script
src="https://googl…

43. <script
src="//google.com/…
<script
src="https://googl…

44. performance

45. 2008 HTTPS is slow

46. 2008 HTTPS is slow
2015 HTTPS is fast

48. Many graphics from The Noun Project
Tombstone by Jakob Wells. Money by Nick Levesque.
Shield by Wayne Thayer. SEO by Azis. Gauge by
Dalpat Prajapati. Scribble by Michael Chanover. Lock
with keyhole by Brennan Novak. Warning by Icomatic.
Error by Anas Ramadan.

49. problems

50. problems

51. solved
problems

52. NoHTTPS?
ask
nicely.

53. NoHTTPS?
SoundCite
placehold.it

54. mixedcontent

55. mixedcontent
$
mixed-­‐content-­‐scan

56. mixedcontent
Content-­‐Security-­‐Policy:
upgrade-­‐insecure-­‐requests

57. mixedcontent Content-­‐Security-­‐Policy-­‐
Report-­‐Only:
default-­‐src
https:
data:
'self'
'unsafe-­‐inline'
'unsafe-­‐
eval';
report-­‐uri:
https://myserver.com/log-­‐
tool/

58. mixedcontent