In order to compete in a competitive market, whether you are a small start-up company or a large enterprise, efficient tools are required to get ahead. There are many roadblocks, and poor organization of the IT environment is something that will slow you down the most. Office 365 from PRO ISP can help you avoid that.
What is Office 365?
Office 365 is an integrated experience with applications and services designed to help you follow your interests and grow your business. Get apps like Word, Excel, PowerPoint and more, and get them updated continuously with the latest features and security updates.
With a cloud-powered email solution you will always be able to stay in touch with customers and colleagues, wherever you may be.
Microsoft Teams, the hub for collaboration in Office 365, lets you chat with colleagues, hold meetings, and share files. You also get a terrabyte of storage where you use OneDrive to keep documents and important files in sync across all your devices.
Run your business with business applications that let you manage customer care, billing, referrals and more, from one place.
All of our Office services come with a 99.9% uptime guarantee and have a complete Microsoft service guarantee.
Lead your business forward with Microsoft 365
Fully installed and always updated versions of Outlook, Word, Excel and PowerPoint for Windows or Mac will help you boost your business going forward. We’ve written a bit about the most important features that can help you.
Get the latest features and features with the fully installed and always updated versions of Outlook, Word, Excel, PowerPoint for Windows or Mac, OneNote (features vary), Access and Publisher (PC only).
Contact and cooperation
Instant access to everything your teams need with Microsoft Teams, including chat, content, tools, and people.
1 TB of secure cloud storage
No matter where you are and on which device, you can edit and share your documents, photos and more with 1 TB of cloud storage in OneDrive.
Intranet and group areas
Inform and engage the organization and connect people to content, expertise and processes with team areas via SharePoint. Tell your story with great websites.
Email and calendars
Get professional email through Outlook with a 50 GB mailbox per user and the possibility to send attachments up to 150 MB.
Work across multiple devices
Get the fully installed Office applications on up to 5 PCs or Macs, 5 tablets, and 5 phones (including Windows, iOS, and Android) per user.
Professional digital storytelling
With Sway you can easily create engaging, interactive online reports, presentations, newsletters, tutorials and more.
Instant messaging and online meetings
Communicate using text, voice or video calls with Microsoft Teams. Host online meetings using one-step screen sharing and HD video conferencing.
Intelligent search and discovery
Discover content and expertise across your organization with intelligent search across all data sources, including SharePoint, Delve and Office apps.
Business Essentials vs Business Premium – What should I choose?
There are clearly both price and functional differences between the two different packages you can choose from. The main difference is that you can not install the actual apps on your machine with Essentials, only access the applications via browser, but for many this is enough.
Regardless, you get premium email solution based on Outlook and Microsoft Exchange in both solutions. Here you have 50GB available per account. OneDrive with 1TB per account and a 1TB joint account for the company is also included. Microsoft Teams also works with both types of licenses and as always you get our 5 star support with the purchase.
If you are the kind of person who likes to have the software installed on your computer, we recommend Premium as you will then have the opportunity to install apps on up to 15 devices between computers (Windows, Mac), mobile and tablet.
We will eventually provide you with more detailed information on the exciting features the applications offers that can help your business. If you are have questions just contact us on chat or normal support. We look forward to upgrading your business!
We have started handling any malicious code found on your web hosting account faster and better while also warning you by email. The system is gradually being used on more and more servers and will soon cover all web hosting servers. When the system is in use on all servers you will get a warning within minutes if something is found on any of your accounts.
Why are we doing this?
Malicious code represent a risk to all clients on a server as well as other users online. Hackers can do any of the following with malicious code:
Extract all data you have stored in the account/website or insert code to continually have access to your data without you or your clients knowing about it.
Send spam or phising emails (which will blacklist the IP addresses of the server and result in email delivery problems for all users on the server).
Attack other servers online/your visitors to spread virus/malware or participate in DDoS attacks.
Run code to overload the server to impact yours and other websites on the server.
When we find mailcious files we will follow these steps (where next step is only performed of the previous failed):
Check backup for clean file and automatically restore.
Clean file for mailcious code.
Put file in quarantine.
Put in other words; We try to do the least invasive to your website first and use the more drastic actions only when needed. Due to the risk malicious code represents we have to go to these lengths to keep you, your visitors and the Internet as a whole safe.
What system are you using?
The system we use is called Imunify360 and is provided by CloudLinux (who also provide us with the OS we use on all our web hosting servers). We have been using Imunify360 since CloudLinux launched the system in the beginning of 2017 and have been working together on how it should work since. We finally feel the system is mature enough to use more actively and integrated with our own systems. That is why we start handling these files now.
Imunify360 does a lot more than just finding malicious code in files. Among other it:
Stops attacks on your website with a web application firewall (WAF).
Stops brute force attacks (attempts to find out your password) on services such as SSH, IMAP and more.
Patches software on the server which has known vulnerabilities such as the kernel (without having to reboot the server).
Stops processes running malicious code while also tracking down the orgin of the attack in the logs.
Finds blacklisted domain names.
Imunify360 is in other words an important part of the security of our web hosting servers, and will gradually become more important as the software evolves.
Where can I see the files that have been found?
You have full access to the files and log in the control panel (cPanel) as shown in the guide Malware scanner in Imunify360. You will also be able to restore files from quarantine and white list files identified as malicious when they should not have been (false positive).
Some files mentioned in the emails we send might have been found a long time ago. We could have chosen not to report these, but we do in case they might be important for you. In such old incidents it might also be that the files mentioned are not in your log as Imunify360 did not log these in the same way as they do now.
What should I do if files are found on my web hosting account?
You should first check if your website is working as it should. If the files have been restored from backup or cleaned it should not be necessary to do anything. If they are put in quarantine or deleted you should check if the website solution you use have that file and if it contains malicious code. Ask the provider of the solution or us if you are in doubt.
Back in 2016 we partnered with Symantec (now Digicert) to deliver free SSL certificates to our customers. AutoSSL, cPanel`s solution for free SSL certificates, was also recently launched at the time. However we chose to work with Symantec instead as we believed their solution would be best for our customers.
The two solutions differed in that Symantec`s solution envisioned that you start with a free SSL certificate and add extra functionality as you grow. In other words – the SSL certificate is tailored to your needs. The AutoSSL solution had a very different strategy where the goal was only to deliver free SSL certificates for domains hosted on cPanel. However, at that time AutoSSL was not very well integrated into cPanel and there were issues with the solution.
Why free SSL certificates with AutoSSL
Symantec did unfortunately never live up to what they envisioned and what we envisioned for our customers. There have barely been changes since we started working together. Meanwhile AutoSSL has continually improved in terms of usability and integration in cPanel. As a result of that – the sooner the better – we had to acknowledge that we chose wrong solution back in 2016. We have now discontinued working with Symantec to deliver free SSL certificates and we have already made AutoSSL available to all our customers on all web hosting packages. The last remains of free SSL from Symantec will be removed from our website in a matter of days.
Advantages with AutoSSL
The advantages for you with the new solution is that:
All (sub) domains on the web hosting account will be covered instead of just a single (sub) domain
The certificates are issued/renewed automatically instead of you having to manually issue/renew them on our website
Parked domains is also covered by free SSL certificates now. This is particulary handy for those using the 1-page website builder on their domain name.
The forwarding package is also covered by free SSL certificates now
If you forget to renew a SSL certificate it will be automatically replaced by a free SSL certificate (so that you avoid having an error on your website for all visitors)
You will get free SSL certificate also for mail.yourdomain.com (where yourdomain.com is your domain name) and will be able to setup your email client with SSL using the hostname mail.yourdomain.com instead of cpanelX.proisp.no (where X represents the server number)
Other useful addresses such as webmail.yourdomain.com and cpanel.yourdomain.com can be accessed with https without any warnings as they will also be covered.
You might ask yourself if there is any disadvantages with the new solution when you see the list of advantages. Yes, there is. We don’t get to show you the advantages paid SSL certificates can do for you beyond what the encryption only free SSL certificates delivers. You also don’t get to setup your own SSL certificate specifically tailored to you like Symantec envisioned. But, fear not 🙂 We will eventually add tips about paid SSL where suitable based on analysis of your needs. For example during diagnose of your web hosting – in time.
What about you who already have SSL from Symantec?
If you have:
Only free SSL certificate this will be automatically replaced when it expires.
Free SSL certificate with site seal we will replace this with a PositiveSSL certificate at the same price as your site seal. You will in other words get a paid certificate with 30% discount. The disadvantage is that you have to change site seal, but if you need help to do that we are more than happy to assist.
Free SSL certificate with wildcard (Basic SSL Plus) we will replace this with a PositiveSSL wildcard certificate at the same price. You will in other words get a paid certificate with discount.
How often are free SSL certificates issued?
The new solution issues/renews SSL certificates once per night for all (sub) domains on all web hosting packages that doesn’t already have SSL certificates or have certificates that are about to expire. You can follow the guide “Install free SSL certificate with AutoSSL” if you need to issue a free SSL certificate before it is issued automatically.
Feel free to contact us if you have any questions or comments regarding the change 🙂
LiteSpeed webserver (LSWS) is a webserver with extremely good performance compared to other webservers. LiteSpeed can replace Apache without one having to do any changes to the configuration file for the installation.
LiteSpeed cache plugin
If your installation is located on a server that is running LiteSpeed, you can use powerful plugins from LiteSpeed that will ensure full optimization and caching of your website. There are modules created for WordPress, Joomla, OpenCart, Drupal 8 and several of the popular CMS systems. At PRO ISP LiteSpeed is free to use if you have Pro Medium, Pro Premium or Enterprise web hosting.
LiteSpeed cache for WordPress is one of those powerful plugins available when on LiteSpeed server. The plugin offers optimization of your website, with cache, optimization of scripts and pictures. One of the best benefits of using LiteSpeed Cache plugin is that you can optimize your website with just a few clicks.
When you have installed and activated the plugin, standard configuration will be active, and you will be able to see the four first options under “Settings”. Normally you will not need to change any of these.
Tab #5 – WooCommerce will only be visible if you already have WooCommerce active.
As soon as you active the plugin, the optimization will begin, and standard cache will be activated. To see other settings, select “Show advanced options”. A selection of 12 tabs will appear (thirteen if you have WooCommerce installed).
Optimize (tab #5)
Optimize contains Minify, combining and HTTP/2-push of scripts and is important when optimizing a website. In short terms it removes any unnecessary code, comments and combine CSS and JS files, resulting in fewer request for your visitors.
With the changes mentioned under this section, we had good results from GTMetrix.
This is the results before the Optimize function was activated (cache was already activated).
This is the results after the Optimize function was activated.
If you are not sure which settings to select, we recommend activating CSS Minify, CSS HTTP/2-push, JS Minify, JS HTTP/2-push. Activating CSS Combine, JS Combine can result in scripts and CSS failing.
After you have activated any options or made any changes in the plugin, you should check that your website is working as normal. If you are experiencing problems with the Combine function, but still want to activate this one, you should check out “How to fix problems caused by CSS/JS optimization“.
When activating HTML Minify the source code will not be easy to read should you need to later. All code will be “pressed together” to save resources. It is still recommended to activate this one. Under the same function you will see Inline CSS Minify and Inline JS Minify. These will remove any spacing, sections and comments in all CSS- and/or JS-files.
Load CSS Asynchronously is a function that will make sure CSS and HTML are loaded simultaneously. As a standard CSS is always loaded first so the website will be displayed correctly as soon as it loads. By activating Load CSS Asynchronously, the website will load faster but could give your visitors a bad impression since they will be able to see your website without images and CSS for a second. We therefore recommend you also activate Generate Critical CSS. This will connect to LiteSpeed’s Critical CSS server which will insert the necessary CSS, so your visitors will not see a lesser version of your website. We also recommend to activate Generate Critical CSS in the Background which makes sure the website is loaded automatically in the background and caches ready for when a visitor will want to see the website as fast as possible, without errors.
Load JS Deferred will make sure all scripts are loaded according the HTML-code. Activate this and test your website. If you are experiencing any errors, you should activate Exclude JQuery and try again.
The final option in Optimize is “Remove Comments” meaning comments or scripts typically deactivated by */ or //. These will automatically be removed in the cached version of the website and can in many cases contribute to faster load.
The settings in the Optimize tab can make a big difference to increase the speed for your website. When activated. this function will replace any other plugins (for example Autooptimize) within minify-options.
Tuning (tab #6)
Combined CSS Priority and Combined JS Priority only needs to be activated if you are experiencing problems with your design after activating the options from Optimize.
Remove Query String makes sure a website with different possible strings behind the URL is ignored and only the website shown is cached.
An example could be:
Without Remove Query Strings all these sites will be cached even though it’s the same site as the visitor is currently on. When activating Remove Query String, they are ignored, and resources are saved since only exampledomain.org/product/ball is cached. You can read more about this and see examples on LiteSpeed’s blog.
If you are using Google Fonts, you can load these quicker by connecting to Google servers before the actual load of the website starts. Use Load Google Fonts Asynchronously. Remove Google Font will remove any external fonts loaded from Google. If you are unsure if you need these options, you can check your website after activating and see if it works better.
We will not be looking into rules/excludes as this is highly advanced.
Remove WordPress Emoji will reduce the number of requests from your website. We recommend this since you can use standard emojis if needed.
Media (tab #7)
We will leave Lazy Load Images remain inactivated since this is a function you alone should consider if you need. Perhaps not everyone will need this, but it will save resources when it comes to loading the website, but remember you need to satisfy both visitors and search engines.
Optimize Automatically we recommend activating as this will activate optimization of your images. We also recommend activating Optimization Cron, Optimize Original Images, Optimize WebP Versions, Optimize Losslessly and Image WebP Replacement.
After activating these, you can click “Image optimization” under the options for LiteSpeed. You will have an overview of how much space you have saved and a que of how many images being optimized.
As an example, we have uploaded an image of 1,4MB which was already optimized by a third party, after a few minutes of processing in the background, I got an 8% less image file size. With standard settings you will not see any noticeable changes to the image.
CDN (tab #8)
In this tab we will insert CloudFlare’s API at the bottom of the page, since the website is using CloudFlare nameservers. If you are not using CloudFlare (or any other CDN) you can ignore this. You do not necessarily need CDN if your target group is in Norway and you are located on a Norwegian server. CloudFlare has many other interesting functions included in our web hosting. If you are expecting a lot of tragic from abroad, you should use this.
Regarding Load JQuery Remotely you should only activate this is your visitors are from other countries than Norway since both Google and Cdjns can retrieve this from foreign servers. Analytics sites will also consider this as external requests.
In short terms this is a function within cache, displaying different cached websites for different roles (guest, admin). We recommend activating this in addition to Cache Admin Bar and Cache Comment Form.
Vary Group settings do not need to be altered, unless you have a web shop with different prices displayed according to role (for example retailers seeing different prices than private parties).
Advanced (tab #10)
The only option we are going to activate is Browser Cache with a TTL of 1296000. You can also leave the standard values as is. Browser Cache stores logo, images and fonts locally on visitor’s units so they will not need to load this every time they visit the website or any other of your links. Most static files that is rarely altered will be stored. TTL do not need too be to high as you will sometimes change the content. Anything from one day in seconds to one month is fine.
We will not be looking into Object Cache as this is highly advanced.
Debug (tab #11)
If you suspect any errors on your website is caused by LiteSpeed, you can activate “Disable All Features”, store and then check your website (remember to deactivate after).
In this tab you can also alter how much information is logged. You can deactivate ADMIN-AJAX by deactivating “Heartbeat”. You should not do this unless you have a valid reason.
Crawler (tab #12)
Currently only Enterprise servers have this function available, so we will leave this out of the article. If you are interested, please contact us and we will help you select the best web hosting.
In this tab we have activated all options and left Product Update Interval remain on “Purge Product on changes to the quantity or stock status. Purge categories only when stock status changes.”
* You will only see this if you have the web shop module WooCommerce installed and activated.
If you wish to be located to a LiteSpeed webserver please follow instructions in “Change web hosting server”. If you wish to upgrade in order to move to a LiteSpeed webserver please follow instructions in “Upgrade services”.
Our hosting server is running version 74 of cPanel and this week all servers will be upgraded to version 76. There are no major changes in this upgrade, but some changes are worth noting.
New “domain” overview icon
There will be a new icon in cPanel that shows a better overview of adddon domains associated with your hosting package. If you have additional addon domains, then this icon will be very useful. You can choose which folders the different domains should point to and you can go directly to email creation for the domain name in the list.
You could also do this before, but it is now simplified for you.
Internal PHP in cPanel is upgraded
cPanel will upgrade PHP version from 5.6 to 7.2. Based on our tests, there is a noticeable difference in speed within the cPanel itself. Navigation and response has been significantly faster and better.
SquirrelMail is removed in version 78
On new servers with version 76, webmail software Squirrelmail is no longer available. From the next version (78), Squirrelmail will also disappear from our older servers. This is mainly due to safety reasons. You can read more about this in “The Death of SquirrelMail”.
Fake emails are one of the biggest security threats online against private individuals and companies. Behind these emails are scammers trying to steal your personal information to abuse this. In a survey conducted by Intel Security, 80% of people cannot identify phishing emails.
What is a fake email and what is phishing?
A fake email is a type of fraud. Most of the times so called phishing is used. Phishing is a term for digital spying or “fishing” for sensitive information, such as passwords or credit card information.
A phishing email will try to cheat the receiver into believing the sender of the email is someone else. The email will contain logo and other elements to give the impression its a serious and genuine email. It will encourage you to click the links in the email. These links will lead to what may appear as a serious website, such as Google, DNB or any other companies we deem as secure and trustworthy. In reality you have now accessed a fake website created by the scammers, who will have access to any information you enter on the website.
As much as 95% of all attacks on company’s networks are the result of a successful spear phishing attack (an advanced and targeted form of phishing often directed towards companies) according to Networkworld.
There are several precautions you can do in order to avoid being a victim to fake emails and phishing, as a person and a company. An advanced and sophisticated spam filter is the first line of defense since this will stop many of the fake emails. All our web hosting includes spam filter. If you have Pro Premium hosting you also have access to SpamExperts, which is a more advanced and accurate spam filter.
Since the human factor is the weakest link when it comes to this problem, the most important measure you can do is get yourself (and your employees) familiar with some guidelines:
Do not trust senders name
One of the most used tactics for fake emails is abusing the senders name. Do not trust the senders name, but also check the email address as well. If it seems suspicious, do not open the email.
Look, but do not click
If the email contains links, hover the mouse over these to check where they lead but do not click. If the link appears suspicious, do not click them.
Check for spelling mistakes
Companies and organizations are meticulous with their emails. Serious emails normally do not have spelling mistakes or poor language.
Analyze the subject
If the email is addressed to “Dear client” it could be a sign of a fake email. Companies and organizations normally use a greeting including at least the first name of the client.
Do not give out personal information
Banks and companies with access to sensitive information will never ask you to provide this information via email.
The use of “urgent” or any threatening language in the subject
Giving the impression the email is urgent or using fear is a tactic often used in phishing emails.
Check the signature
Lack of details regarding the sender and how you can contact the company is often a sign of phishing. Serious companies will always include their contact information.
Do not open attachments
Fake emails often include attachments with malware. If you open this it can destroy files on your computer, steal your passwords or even spy on you without your knowledge. Do not open attachments you did not expect to receive.
These fake emails have become highly sophisticated. Even though an email has the company’s logo, correct spelling and appears to be a valid email, this does not mean it is. Be skeptical and if you find an email to be suspicious, do not open it.
The importance of maintaining security online is nothing new. Many people tend to only think about security when visiting a website, but as an owner of a website, no matter what the type of website it, you need to think about security. Informational websites, blogs, online newspaper, web shop or any other.
Security is important for you as an owner of the website, and for those visiting and using the website. In this article we will take a closer look at how to maintain basic security and what needs to be done if an incident occurs.
Security on your website involves:
It should be safe for everyone to visit the website
The website should not be infected with malicious code that may infect visitors
The website should not forward visitors to any websites with malicious code
Information exchanged between visitors and website/server should not be accessible to anyone unauthorized
The topic is comprehensive and one article cannot cover it all, but we will focus on the most important; It should be safe to visit your website!
Make sure the website is not/cannot be infected
When a website is available online it poses a potential target for hackers. A hacker is not necessarily a man in a black hood in a dark basement. In most cases a hacker is an automated “Bot” (robot). These “bots” are constantly scanning known and unknown websites for vulnerabilities to exploit. Vulnerabilities exist in the code running, directly or in add-ons such as plugins.
A classic example is a website created in WordPress, with a theme and a few plugins installed. Since WordPress is quite popular it is also popular to search for vulnerabilities in this type of installation. If a hacker can successfully infect 1 website, they can potentially do the same to thousands of websites.
The motive behind infecting a website may include; a hacker might want to spread their message, send spam from your account, collect sensitive information from visitors, forward visitors to other insidious websites, use the resources of the account for other attacks and so on. All of the mentioned is of course something you want to avoid. In general, it is rarely you directly, they are targeting.
Checklist to avoid having your website infected
Everything must be updated, always Since WordPress (and other similar systems) is popular, when vulnerabilities are found, improvements are made and updates released. It is important to update when new ones are released. As soon as a vulnerability is detected and known, it is only a matter of time before the websites not updated will be attacked. The same goes for anything installed on the system. As we mentioned in our example, we have a theme and plugins running. These can also contain vulnerabilities and developers release updates correcting this. It’s therefore important to keep both theme and plugins updated as well as the installation itself.
Anything not being used on the hosting should be removed
Any theme or plugins not being used should be deleted/removed. Even if you deactivate a plugin or a theme everything is not actually gone. Files are often left and can potentially be abused. This means; only what is necessary to keep the website running optimal should be openly accessible. Anything else must be deleted or moved to an unreachable area.
Use captcha for forms
Forms; contact forms, order forms and similar must be secure so they cannot be completed automatically. The “bots” we mentioned before can also be used to abuse forms, when available and send spam from website/account. This will affect the visitors in two ways:
1. Resources for the hosting can be used for this, preventing visitors from loading the website.
2. Causing abuse of such a magnitude that the account will be suspended to avoid further issues. Suspension means the website will be offline and not available for visitors. All forms where visitors can fill in information, should have an extra check. Captcha is the most common (and recommended) check for this.
Password must be secure
A secure password is long and composed by numbers, small and uppercase letters and other characters. Long password can also be sentences or phrases with random numbers/letters more easy to remember. Password is used on our client portal, hosting, email and the website/installation. The password used the most is also the most vulnerable. You should change password at least a few times each year. You should never use the same password several places.
Implement extra security wherever its possible
For many CMS (WordPress/Joomla/Drupal) special plugins are developed focus solely on security. Check what needs you have and install what you think is best for your website and needs. There are several decent free options, but if you have a larger website with heavy traffic it can be worth paying for the extra security. Sucuri (sucuri.net) provides a free plugin as well as a paid version and is known for value for money.
Make sure to always have a backup of your content
You should always make sure to have a backup of your content. All of our clients have access to the best solution in the market for backup. At PRO ISP you have access directly to your backup via the control panel (cPanel). Backup is performed once each day of all the content and is kept for 30 days. In addition to the backup solution with PRO ISP we recommend always having an external backup. Once each month or once each quarter, depending on how critical it is and how many changes you are willing to lose.
Website has been infected, what to do?
What if the damage has already been done? What if your account has been suspended by PRO ISP? This can happen to anyone and most people experience it as unfair.
All hosting companies operate the same way when it comes to hosting; several hosting share resources on the same server. To illustrate, imagine the server as a hotel and the clients account as hotel rooms in the hotel.
When a hosting company detects resources being abused, this must be stopped to avoid it affecting the other clients in the same hotel. Imagine a hotel room with so many visitors that no other guest can get in or out of their room. The room creating the problem will have to be closed to avoid this. Its not always an account will be shut down, but if signs of hacking/abuse is noticed we can notify directly.
The most important in such cases is; follow the instructions given and ask for tips/advice/guidance if you are unsure.
If we detect hacking/abuse, and either give notice or suspend the account, we always give instructions on what needs to be done.
In most cases the hacking is so recent you can use a backup included in the hosting. The procedure is easy:
Delete content on hosting related to the website.
Restore content from a date before hacking/abuse occurred (if you are unsure, use the oldest backup available)
Review all the mentioned measures above to prevent further hacking/abuse. Update everything, secure all forms, change all passwords and implement extra security
If you do what is recommended and follow this you are as secure as possible. Both you as the owner of the website, the visitors, and we who serve the website form our servers will be happy.
Secure information between visitors and server (SSL certificate)
Security certificate is becoming more and more relevant to discuss, and highly useful when it comes to security for websites. We have previously had articles about “SSL certificate- How to chose the right one” and how larger suppliers are planning to force more and better use of this to maintain security online (“Google warns: Secure your website”). Now it is about to get a little technical but we will need to explain some technical stuff:
SSL* is an encryption protocol, or a set of rules telling a server/client (website and visitors) how encryption of the data will be executed. The encryption is the process of making something unreadable or incomprehensible to others.
* In reality TLS is used, but SSL and SSL certificates are used in everyday speech so therefore also in this article.
The end goal for SSL is to make sure the visitor, and the server/website, will be able to read the data sent between these two parties. It is therefore essential when personal and sensitive data is exchanged, such as phone number, username, password, e-mail addresses, credit card information and similar; because we do NOT want this information seen by others.
In order to enable this encryption we use “keys”. When the visitor and a server/website have the same kind of “key”, only they can read, and encrypt the information. An SSL certificate is a certificate confirming the ownership of the “keys”, and that they are authentic and valid. How thorough this confirmation is, depends on the certificate, read more about it in “SSL certificate – How to choose the right one”. In short terms the certificate confirms it has been issued by a valid issuer, for the website visited, and its validation for this. As a visitor, you can see this by the green padlock in the address field and that the browser reports the website as secure.
As mentioned in “Google warns: Secure your website” encryption of information is highly relevant since it will be a demand soon. You can of course avoid using SSL certificates, but visitors of the website will be receiving a warning when entering your website. This warning can compare to shouting at your customers: “I do not care about security”. If you have not made the transition from http to https the time is definitely now!
Du you have any questions?
In the beginning of the article we mentioned security is a quite large topic and cannot be covered in one single article. Still, follow the advises given, and be more aware of security you will have come a long way already.
Did you read the article and is left with many questions? Do you want some guidance? Please, do not hesitate to contact us.
Security for websites are undergoing major changes. The extent of these changes is comprehensive and will affect all websites using HTTP:
The implementation of the changes has been done gradually and the “final” date has been changed several times, but according to Google (8th of Febuary 2018) you will need to make your website secure by the beginning of July. If you still have a website using HTTP after this your visitors will see this when using Chrome:
HTTP has been used for many years, but has a major flaw. All data transfered via HTTP can be stolen or manipulated because it’s not secured.
HTTPS is secured and ensures all data transferred is encrypted and protected. We can therefore understand why web browsers now will require the use of HTTPS as standard.
The data is not only protected and encrypted but using HTTPS will give up to 5% increased visibility in search engines and more options for your mobile website. HTTPS also enables the use of HTTP/2 which provides 20-30% faster page load compared to HTTP.
How do I get HTTPS?
In order to get HTTPS your website needs to have an SSL certificate. Choosing the correct SSL certificate can be confusing. We recommend reading “SSL certificate – how to choose the right one”. Please do not hesitate to contact us and we will help you choosing the right SSL certificate for your website.