HTTPS & tín hiệu bảo mật

Security as a visibility signal

HTTPS has been a ranking signal for years, and browsers now actively warn on plain HTTP pages and mixed content. One insecure script on a secure page can break the padlock and, with it, visitor trust. HSTS tells browsers to never even try HTTP again.

Security failures also get sites de-listed abruptly: a hacked page injected with spam can trigger warnings in results within days.

What this site measures

Whether the site serves over HTTPS, whether HTTP redirects to HTTPS, the HSTS header, mixed-content references, declared charset, and modern protocol support (HTTP/2 or newer).

How to improve

• Certificates are free (Let's Encrypt) and automatic on most modern hosting.
• 301-redirect all HTTP URLs to their HTTPS twins, sitewide.
• Fix mixed content: every script, style, image and frame loads over https.
• Add HSTS once you're confident HTTPS is stable everywhere.
• Keep platforms and plugins updated; most hacks exploit known old bugs.

Common mistakes

A valid certificate but no redirect, so both versions live in parallel. Hardcoded http:// image URLs from an old migration. Letting the certificate lapse on the weekend nobody's watching.