With GDPR coming along shortly, I am working my way around the hosting accounts and where it is possible, I am enabling a security certificate for each domain.
Unlike the previous hosting we were in, this one offers free security certificates, they normally cost around £75 per year. They are free to me, so they are free to you.
What does this mean?
It means that when a visitor comes to your website they do not go to http:// they go to https:// the “s” is important because it means the data going to and from the website is generally* encrypted. I will explain why I have said “generally” in a moment”. SSL means Secure Socket Layer.
What is particularly important is anything entered into a form is encrypted between the user and the website, and therefore nobody can intercept it on the wire. When your site was first built we were not able to use SSL certificates, and all requests and data entered between a client and the server were in plain text. If they could be intercepted then they could be read.
This provides you with some coverage where GDPR is concerned, because action has been taken on all transactions that may contain personal information such as that which may be in a contact form.
I don’t have a precise timeline for this, I am working my way around.
Why did I say generally*
The website was built over an http:// connection, so it was not secure. Within the website there will be hundreds of links when the website is constructed in the browser that use http:// still to serve images. There may be other cases, but we are aware that images are not encrypted. But form data being sent back is encrypted back to the web server.
If a page is fully secure you will see a symbol like this in the browser (Chrome)
If a page is secure but has elements in it that are not, then you will see a symbol like this
If you were to click on the small i in the circle it would tell you what is encrypted and what is not. The difference on the second URL is there are some images on this page which are referenced as http:// and not https:// which are in the database and were created when the site was first built.
How easy is it to fix?
To fix this you need to backup the site using Updraftplus and re-install it. Updraft should detect the presence of these and change them all to https://. If it does not, then next easiest way to resolve this is restore the site somewhere else, back it up again (this forces the URL to change) and then restore it back. Obviously more complicated. I can handle that for you if that is important to you. Contact me for more details, or refer to this article which covers several other aspects of security