APA-OTS WordPress Multi-Site HTTPS Migration: a Case Study Jeremy Chinquist APA-OTS Sept. 2017

Questions Addressed: Why should a WordPress website be migrated to the HTTPS protocol? How can a WordPress multi-site website be migrated to the HTTPS protocol? How can this task be accomplished seamlessly… …without loss of site traffic …without duplicate content (SEO) …without loss of site speed …with avoiding errors and the common pitfalls

Impetus Chrome & Firefox draw attention to insecure connections Search engines will start to penalize insecure websites (Q2 2016) EU General Data Protection Regulation / EU-Datenschutz-Grundverordnung (EU-DSGVO) Further reading: https://www.clickseed.com/http-https-migration-guide/

Blockers Cost per HTTPS Certificate / domain Wild card certificates help Free services such as letsencrypt Transition project costs

Decision APA-OTS makes the transition once All future websites will be HTTPS only If a certificate is too expensive for a project, the project does not get greenlighted (APA-OTS Web Development)

Questions Addressed Why should a WordPress website be changed from the HTTP to HTTPS protocol? How can a WordPress website be changed from the HTTP to HTTPS protocol? How can this task be accomplished seamlessly? Without loss of site traffic Without duplicate content (SEO) Without loss of site speed

Milestones Preparation HTTP only (HTTPS redirects to HTTP) Load Balancer (optional) HTTPS Certificate(s) installed Test site is HTTPS ready Transition: HTTPS only (HTTP redirects to HTTPS) Monitoring Clean-Up

Preparation phase Multi-Site instance serves: https://service.ots.at https://www.apa-campus.at https://www.euroadhoc.at https://videomanager.ots.at/ 4 internal Rest-API-only sites 3 internal sites with custom forms & post types Several unique workflows

Preparation phase Customized checklist based on: https://www.clickseed.com/http-https-migration-guide/ Discussions How can this task be accomplished seamlessly? Without loss of site traffic Without duplicate content (SEO) Without loss of site speed

Preparation phase: discussions Follow / revise the checklist for APA-OTS needs Rely on a load balancer Better flexibility Improved page load speed Implement HTTPS certificates first on all sites, then transition Reduces web-site cross linking issues Hard-coded protocols can always be updated to HTTPS as needed. 301 redirect HTTPS to HTTP except for https://www.example.com/robots.txt

Milestone: HTTP only (HTTPS redirects to HTTP) Redirect all traffic to HTTP via .htaccess # force HTTP (apache reads as „(A OR B) AND C“ RewriteCond %{HTTPS} on [or] RewriteCond %{HTTP:x-forwarded-proto} https RewriteCond %{REQUEST_URI} !/robots\.txt RewriteRule .* http://%{HTTP_HOST}%{REQUEST_URI} [L,NE,R=301] If some sites should not be forced, consider using wp-config.php

Daily reminders Check Google Webmaster Tools daily Add the HTTPS account now! Make certain Google reports that crawlers are locked out of HTTPS Webmaster Tools alerts you if the HTTP site is no longer crawlable Check Google Analytics daily If you see a dip in page views, check crawler access Check sitemaps All sitemap links should be HTTP Robots.txt for HTTPS and HTTP point to the HTTP sitemap file! Take time

Milestone: Test site is HTTPS ready Create a mirror site locally and test Is the theme HTTPS ready (no hardcoded links in the theme, use the WP core setting) The blog posts will have HTTP links – this will be done via a DB search / replace in text! Images will also be HTTP hard-coded. Again, this will be done via DB search / replace. Record HTTP load times via for comparison later https://www.webpagetest.org/

Milestone: Test site is HTTPS ready The hard way: For each table and domain do Update with REPLACE([column name], ‘http://', https://'). Save all commands in an SQL file OR you can do it the easy way: https://interconnectit.com/products/search-and-replace-for-wordpress-databases/ In this case the motto is “do the search / replace several times and test, test, test!”

Transition: HTTPS only (HTTP redirects to HTTPS) Backup the site! Allow yourself a good amount of down time! Remove the .htaccess code (see earlier slide) Update website settings for HTTPS Install https://wordpress.org/plugins/wp-force-https/ Run database updates or search / replaces Clear WP-Super-Cache (or other caching) Verify robots.txt is loading properly for both HTTP and HTTPS! Force your sitemap to update (and verify it uses https) Switch cron-job entries to HTTPS If some sites should not be forced, consider using wp-config.php

Daily reminders Check Google Webmaster Tools daily Force the HTTPS site to get the robots.txt file that allows it access Force the HTTP site to get the robots.txt file that denies it access Make certain Google reports that crawlers are locked out of HTTP but allowed HTTPS Webmaster Tools alerts you if the HTTPS site is no longer crawlable Check Google Analytics daily If you see a dip in page views, check crawler access

Daily reminders Check sitemaps All sitemap links should be HTTPS Robots.txt for HTTPS and HTTP point to the HTTPS sitemap file Webmaster tools will report indexing of the HTTPS site This can take a few weeks The HTTP site will go down slower than the HTTPS site indexes Google searches will start to yield HTTPS entries Use https://www.webpagetest.org/

Milestones » Clean-up APA-OTS had more pages indexed by Google after the transition We cleaned up a few items The load balancer transition made for better page-load times Throw away your back-up site files – you won’t be needing them ever again ;-)

Thank you for your attention! Jeremy Chinquist 0676 451 3889 jeremy.chinquist@apa.at http://service.ots.at www.ots.at @apaots