Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

A client of mine is a workshop-based school that gets ~80K page views per month, caters to creative professionals, and offers course registration (and payment) online. The payment portions of the site are hosted by a third party and are already secured with SSL.

My question: are there any disadvantages to serving the entire site via an https connection, redirecting any http requests? I'm unsure of the SEO impact, but bandwidth and speed aren't issues since we use a CDN service.

Basic membership details are collected over http (name, email, employer), and after a few years we finally got a complaint about the fact that this isn't more secure. Before buttoning up the entire site, I want to understand the implications of that choice.

share|improve this question

1 Answer

up vote 7 down vote accepted

The main concern used to be CPU, but with 80k views/month and modern servers that won't be any sort of trouble for you. You'll want to look carefully for any third-party JS, images, etc. that might be delivered over HTTP and switch them to HTTPS so users don't receive an insecure content warning.

share|improve this answer
Eliminating HTTP references should be a breeze, and now I can implement with a bit more confidence. Thanks, ceejayoz! – Matt Jan 10 '12 at 15:31
2  
Don't forget about caching - if any of your clients are behind a proxy server, that proxy won't be able to cache anything from an HTTPS-only site. As a squid admin I'm not so fond of the current trend for making everything HTTPS, regardless of need. It reduces the efficiency of my squid cache :-) – James O'Gorman Jan 10 '12 at 19:11
1  
Thank you, James! – Matt Jan 17 '12 at 17:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.