HTTPS, or “secure” HTTP, is a technical protocol that’s getting a lot of buzz right now. You’ve probably heard techies recommending it because it is more private, more secure, and all around better for a website’s visitors – and it doesn’t hurt that Google gives you a small SEO boost if you use it.

Now Automattic, the main developer of WordPress, has said that it is going to limit certain features so that they will only work with WordPress sites that use HTTPS. Automattic founder Matt Mullenweg laid out the roadmap in a blog post:

First, early in 2017, we will only promote hosting partners that provide an SSL certificate by default in their accounts. Later we will begin to assess which features, such as API authentication, would benefit the most from SSL and make them only enabled when SSL is there.

FYI: an SSL certificate is one of the requirements for adding HTTPS to a site, but it’s just one of many steps (I’ll explain more later).

Mullenweg’s announcement matters because Automattic makes Jetpack, an immensely popular plugin that adds a couple dozen useful features like a contact form, visitor stats, and upgraded comments, to self-hosted Wordpress sites.

Some of those Jetpack features are going to stop working if a site doesn’t have HTTPS.  We don’t know which features yet, but logic suggests the most likely possibilities include features where privacy is paramount – features like a contact form, visitor stats, and comments.

So if you use Jetpack, or one of the other WordPress plugins developed by Automattic, you should be concerned.

If you have not upgraded to HTTPS, now would be a good time to start the process.

Step One will be to ask your hosting company how to go about it. They will probably send you a link to instructions. Those instructions will be incomplete, but they will be a good start.

Go ahead and read those instructions, but before you follow them you should also read about the fifty-eleven problems you might face.

• Edit: Many hosting companies won’t tell you anything more than that you need to get an SSL certificate. That’s where to start, but that’s not the only step.
• Almost no one thinks to mention this, but if you use Google Search Console then you will need to set up a new entry in your GSC account for the HTTPS version of your site. This may sound strange but Google sees the HTTPS site as separate from the older HTTP version.
• If you use Google Analytics, you will need to enable the setting that tells GA that the correct version of your site is HTTPS, not HTTP.
• You should also look at cleaning up any broken links, badly formed pages, manual actions, or any other problems that might affect your SEO. If Google thinks you are running away from problems by switching to HTTPS then they might penalize you.
• If you rely on social sharing to establish your credibility/popularity, you should be aware that your share counts will vanish when you switch to HTTPS.  Sharing plugins like Social Warfare Pro or AddtoAny can help you get your numbers back up.
• Be prepared for HTTPS to cause conflicts with plugins, or for it to break important features on your site in unexpected ways.
• Also, don’t be surprised if it doesn’t work right away. I have added HTTPS to a dozen existing sites, and each site required the software equivalent of hitting the equipment with a large wrench. It’s not always a clean process but we did get it to work eventually.

In all honesty, I think HTTPS causes enough pain for the average blogger that the frustration exceeds the benefits.

But it is also the wave of the future, so unless you want to be left behind, your site needs HTTPS.

And I can help. If you get stuck, send me an email and I’ll help you figure out the next step.

image by photobyleigh