Google will begin penalizing sites that don't use HTTPS

David Chrystal · September 2017

My webteam forwarded this news, which they also received as an email from Google: https://blog.malwarebytes.com/101/2017/09/google-reminds-website-owners-to-move-to-https-before-october-deadline/

With the release of Chrome v62 in less than 3 months, Google will begin marking non-HTTPS pages with text input fields—like contact forms and search bars—and all HTTP websites viewed in Incognito mode as “NOT SECURE” in the address bar. The company has started sending out warning emails to web owners in August as a follow-up to an announcement by Emily Schechter, Product Manager of Chrome Security Team, back in April.

Digging a little deeper into the info about Google's plans, the October changes are just the beginning--eventually all HTTP pages will be penalized with a bright red "not secure" icon.

Does Blackbaud have plans to address this for non-secure pages built in Luminate Online? Over 50% of our site visitors use Chrome and I'm sure other NGO's see similar trends. Many of our Luminate Online pages are non-secure, including several that are targeted email capture pages (so they will fall into the "contact forms" category that Google will begin penalizing). One of the drivers of our decision to use non-secure is that non-secure pages appear as subdomains of our main website, whereas secure pages display as "secure3.convio...". Seems like we're about to experience a dip in performance because of these non-secure pages.

Lisa Slawinski · September 2017

David Chrystal:

My webteam forwarded this news, which they also received as an email from Google: https://blog.malwarebytes.com/101/2017/09/google-reminds-website-owners-to-move-to-https-before-october-deadline/

With the release of Chrome v62 in less than 3 months, Google will begin marking non-HTTPS pages with text input fields—like contact forms and search bars—and all HTTP websites viewed in Incognito mode as “NOT SECURE” in the address bar. The company has started sending out warning emails to web owners in August as a follow-up to an announcement by Emily Schechter, Product Manager of Chrome Security Team, back in April.

Digging a little deeper into the info about Google's plans, the October changes are just the beginning--eventually all HTTP pages will be penalized with a bright red "not secure" icon.

Does Blackbaud have plans to address this for non-secure pages built in Luminate Online? Over 50% of our site visitors use Chrome and I'm sure other NGO's see similar trends. Many of our Luminate Online pages are non-secure, including several that are targeted email capture pages (so they will fall into the "contact forms" category that Google will begin penalizing). One of the drivers of our decision to use non-secure is that non-secure pages appear as subdomains of our main website, whereas secure pages display as "secure3.convio...". Seems like we're about to experience a dip in performance because of these non-secure pages.

David,

Thanks for sending. I'll be interested in seeing how Blackbaud responds.

Lisa

Philip Nawrocki · September 2017

This was mentioned in the Quarterly Update today at around the 24 minute mark.

I am sure the recording will be up on the community soon.

Romany Nassief · September 2017

Philip Nawrocki:

This was mentioned in the Quarterly Update today at around the 24 minute mark.

I am sure the recording will be up on the community soon.

Sharing the related webinar slides:

fcf9c879ca4ae8693da2ad8fd1d795b6-huge-tl

Kathryn Hall · September 2017

Philip Nawrocki:

This was mentioned in the Quarterly Update today at around the 24 minute mark.

I am sure the recording will be up on the community soon.

Recording and slides are on the Community now: https://community.blackbaud.com/forums/viewtopic/5/35840

David Chrystal · September 2017

Thanks for sharing and great to see Blackbaud is out ahead of this! Will we need to do anything to get all our pages HTTPS? Is there anything we should be doing now?

Kathryn Hall:

Philip Nawrocki:

This was mentioned in the Quarterly Update today at around the 24 minute mark.

I am sure the recording will be up on the community soon.

Recording and slides are on the Community now: https://community.blackbaud.com/forums/viewtopic/5/35840

M OConnell · September 2017

Not sure if this helps - but we've been finding that we can call existing resources from LO either as secure or unsecured just by updating and using the right protocol in the Form post for certain applications (like Surveys and Donations).

Of course, as long as all the components of these pages refer to other secure sources, and you enable SSL (when building the page, you have the option on one of the screens), you should be able to keep the session encryption intact...

Example:

If you have access to your Convio FTP, try to bring over any dependency that might be hosted elsewhere and relink. Makes the whole job easier.

Also, before all these, be sure you have an SSL certificate set up. We purchased one that covers all subdomain URLS, a "wildcard" certificate and it works like a charm.

Hope this helps!

Google will begin penalizing sites that don't use HTTPS

Comments

Categories