{"action":"created","issue":{"url":"https://api.github.com/repos/websharks/s2member-kb/issues/232","labels_url":"https://api.github.com/repos/websharks/s2member-kb/issues/232/labels{/name}","comments_url":"https://api.github.com/repos/websharks/s2member-kb/issues/232/comments","events_url":"https://api.github.com/repos/websharks/s2member-kb/issues/232/events","html_url":"https://github.com/websharks/s2member-kb/issues/232","id":91335439,"number":232,"title":"Introduction to TLS/SSL and Why You Need It on Your s2Member Site","user":{"login":"patdumond","id":9320495,"avatar_url":"https://avatars.githubusercontent.com/u/9320495?v=3","gravatar_id":"","url":"https://api.github.com/users/patdumond","html_url":"https://github.com/patdumond","followers_url":"https://api.github.com/users/patdumond/followers","following_url":"https://api.github.com/users/patdumond/following{/other_user}","gists_url":"https://api.github.com/users/patdumond/gists{/gist_id}","starred_url":"https://api.github.com/users/patdumond/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patdumond/subscriptions","organizations_url":"https://api.github.com/users/patdumond/orgs","repos_url":"https://api.github.com/users/patdumond/repos","events_url":"https://api.github.com/users/patdumond/events{/privacy}","received_events_url":"https://api.github.com/users/patdumond/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/websharks/s2member-kb/labels/draft","name":"draft","color":"fef2c0"},{"url":"https://api.github.com/repos/websharks/s2member-kb/labels/tutorials","name":"tutorials","color":"0052cc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":7,"created_at":"2015-06-26T19:03:53Z","updated_at":"2015-07-31T15:39:09Z","closed_at":null,"body":"## Introduction to TLS/SSL and Why You Need It on Your s2Member Site\r\n\r\n##### KB Article Creation Checklist\r\n\r\n- [x] Write initial draft for this KB Article; label this issue draft and either questions or tutorials\r\n- [x] Add required YAML configuration\r\n- [x] Add Tags for this KB Article to the YAML config (see YAML Keys (Explained))\r\n- [ ] Edit and finalize draft for publishing (remove draft label, add draft-finalized label)\r\n- [ ] Create Markdown file for this Article (remove draft-finalized label, add pending label)\r\n- [ ] Publish KB Article (remove pending label, add published label; leave this step for the Project Lead)\r\n\r\n```\r\ntitle: Introduction to TLS/SSL and Why You Need It on Your s2Member Site\r\ncategories: questions\r\ntags: security, s2member-security-badge\r\nauthor: patdumond\r\ngithub-issue: https://github.com/websharks/s2member-kb/issues/232\r\n```\r\nWhat do words like \"cyber-stalking\", \"identity theft\", \"credit card fraud\", and \"packet sniffing\" have to do with your website? Hopefully, not much. If you are reading this, however, then you probably either own or manage a membership website. Almost by definition, you collect your members' personally identifiable information on that site. If you are doing that on an unencrypted web page, you are placing your members' data and your website (and livelihood) in jeopardy.  Everytime a user fills out a form on your site their information may be leaving your site in clear text any hacker or \"script kiddie\" can grab. If you display user information on profile pages or membership directories, that information is unencrypted as well. \r\n\r\n### What is TLS/SSL? \r\n\r\nAccording to [Wikipedia](https://en.wikipedia.org/wiki/Transport_Layer_Security) (which just recently implemented the HTTPS protocol on all of their websites):\r\n\r\n >Transport Layer Security (TLS) and its predecessor Secure Sockets Layer (SSL) are cryptographic protocols designed to provide communications security over a computer network.\r\n\r\nSSL is an out-dated protocol and has been superseded by TLS. However, the term \"SSL\" is commonly used to describe the protocols implemented by the **HTTPS** protocol on the web. These protocols use certificates and asymmetric cryptography to ensure that your web browser is talking to the site you intended. This is called \"authentication.\" \r\n\r\nOnce each side of the connection is sure they know who is on the other end of the link, they negotiate a session key to encrypt all data flow for the duration of the connection. Authentication ensures that the computer on the other end of the connection is PayPal, not some \"man in the middle\". Encryption ensures the data cannot be read without the session key. \r\n\r\nYou can tell you are using `HTTPS` and not plain old `HTTP` by looking at the address bar of your browser. The address of the website should be preceded by `HTTPS` instead of `HTTP`. If you have a valid `HTTPS` connection, you'll see a closed padlock.  If the padlock is not closed or you see another symbol instead of a padlock, hover your cursor over the image, and you'll get more information about the connection. \r\n\r\n![https connection](https://cloud.githubusercontent.com/assets/9320495/9010837/785420fa-3777-11e5-9e67-688cf138dafe.png)\r\n\r\n## Why Use TLS/SSL\r\n\r\n### Authentication and Encryption Lower the Risk of Data Theft\r\n\r\nImplementing TLS/SSL on your website secures network communication between your site and other sites (such as PayPal or Stripe). It does not prevent your website itself from attack, but it does prevent your users' data from being read while it is traveling \"through the ether\".  One of the obligations you undertake when you ask people for their personal information is the duty to do everything you can to protect that information from theft by third-parties. Implementing TLS/SSL on your website is part of that obligation. \r\n\r\n### That Little Padlock Engenders Customer Trust\r\n\r\nTry googling \"how do I know if a website is safe\" or \"how do I know if a website is secure\" and check out as many results as you want. Somewhere on that page you'll see words like \"Look for the little green padlock\" or \"The site has a padlock or unbroken key\".  People trust that little green padlock. \r\n\r\n### Implementing HTTPS Can Raise Your Search Engine Rankings (and vice versa)\r\n\r\nGoogle started giving a [slight ranking benefit to websites using `HTTPS` in 2014](http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html).  While Google said this benefit was \"very lightweight\" and carried less weight than other factors, such as high-quality content, every little bit helps in the never-ending quest for more traffic. Also noteworthy was Google's reasoning for the change and for possibly strengthening the boost in the future. They said they wanted to \"encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web\".  \r\n\r\n[SearchMetrics posted in March 2015](http://blog.searchmetrics.com/us/2015/03/03/https-vs-http-website-ssl-tls-encryption-ranking-seo-secure-connection/) that they had begun seeing positive effects in SEO rankings due to HTTPS implementation. \r\n\r\n## How Do I Implement SSL?\r\n\r\nYou've seen the benefits of using TSL/SSL:\r\n\r\n* Securing user's personal information during network transport.\r\n* Engendering user trust with that \"little green padlock.\"\r\n* Giving your Google rankings a boost,\r\n\r\nNow you probably want to know how to implement TSL/SSL on your s2Member site. Well, stay tuned for our follow-up Knowledge Base Article, **How Do I Implement TSL/SSL on my s2Member Site?**. "},"comment":{"url":"https://api.github.com/repos/websharks/s2member-kb/issues/comments/126727166","html_url":"https://github.com/websharks/s2member-kb/issues/232#issuecomment-126727166","issue_url":"https://api.github.com/repos/websharks/s2member-kb/issues/232","id":126727166,"user":{"login":"patdumond","id":9320495,"avatar_url":"https://avatars.githubusercontent.com/u/9320495?v=3","gravatar_id":"","url":"https://api.github.com/users/patdumond","html_url":"https://github.com/patdumond","followers_url":"https://api.github.com/users/patdumond/followers","following_url":"https://api.github.com/users/patdumond/following{/other_user}","gists_url":"https://api.github.com/users/patdumond/gists{/gist_id}","starred_url":"https://api.github.com/users/patdumond/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/patdumond/subscriptions","organizations_url":"https://api.github.com/users/patdumond/orgs","repos_url":"https://api.github.com/users/patdumond/repos","events_url":"https://api.github.com/users/patdumond/events{/privacy}","received_events_url":"https://api.github.com/users/patdumond/received_events","type":"User","site_admin":false},"created_at":"2015-07-31T15:39:09Z","updated_at":"2015-07-31T15:39:09Z","body":"I think this is ready for a final review and publication if nobody has any other edits to make."}}