SSL Implementation: Best Practices and Beyond

Security Should Be Website Job #1

Website design, responsiveness, apps, performance, and cloud are the sexy topics these days. They get a lot of attention and we’ve helped hundreds of customers accomplish each of them. But whenever we are working directly with business customers or in partnership with another developer, we always make sure that website security is in the must-have list. For us, it’s just not an option … it has to be a top priority.

Having those kinds of conversations has become easier over the years. We’ve been writing and “preaching” about website security for years in our blog and through our series of white papers and resource guides. And every time the evening newscast leads with a story about a data breach or hacked website, the need to include security processes and practices in all aspects of website planning and maintenance becomes clearer. Fortunately, DNN is a great platform for implementing website security protocols. But where should you start?

Begin With SSL

Secure Socket Layer (SSL) is a two-way encryption method that ensures that the site visitor and the website itself are the only ones participating in the conversation. The privacy of this conversation is ensured by a trusted, neutral third party – the Certificate Authority (CA) – that verifies the identity of the website so they can establish a secure, encrypted connection.

We did some research for our SSL implementation white paper a few months ago, and we found that 67% of all active websites do not even implement the most basic levels of encryption. This one fact alone is astounding – especially since Google implemented search penalties for unprotected websites earlier this year. Other large browsers and search companies quickly followed suit.

Key Takeaway: Implementing SSL security is no longer just a solid security best practice, it’s a business and marketing imperative.

SSL Certificates Are Not as Difficult as They Used to Be

Fortunately, acquiring an SSL certificate has become relatively easy. There are dozens of CA companies who can help, including global providers Symantec and VeriSign, among others. In fact, the last few years has seen the rise of open source and community-supported CA projects as well. For example, is a community-supported CA that provides SSL certificates at no charge. It is sponsored by developers and business owners – people like you and us – and also by some of the biggest tech companies around. Corporate sponsors include Facebook, Google, Shopify, Automatic, Mozilla, and dozens of others – so the service has the kind of backing it needs to remain a great resource.

Best Practices for Implementing SSL Encryption

Once you have acquired your SSL certificate, here’s what you need to do:

  • Install your certificate as per platform instructions.
  • Test all page content for mis-matches – This means to ensure that all site content is secured by SSL, and there are tools to help you do this.
  • Force all pages to use SSL – In DNN you will find a setting to help you achieve this.
  • Set redirects – Links to previously unencrypted pages need to redirect to their newly encrypted counterparts.
  • Implement Strict Transport Security – prevents browsers from automatically lowering standards on certain requests.
  • Use Google Fetch via the Search Console – When going from non-encrypted connections to SSL, Google interprets this as a site migration even if the site has not moved from one server to another. This action will keep your analytics data and alerts functioning properly.
Key Takeaway: Acquiring and installing your SLL certificate is not enough. Your site can still be unsecure, incur liability, and suffer search penalties unless you implement security best practices.

Detailed Instructions, Code Samples, and Additional Security Best Practices

We have created a complete set of detailed instructions for each best practice listed above – including code samples – and put them in our white paper, titled “SSL Implementation and Website Security Best Practices.” In addition, it details three more best practices for basic website security beyond SSL. We have made this white paper available as a free resource to the community.

On our IowaComputerGurus white paper page you will find this paper along with several other free guides and white papers covering DNN, DNN EVOQ, ASP.NET, and MVC Core development topics. And as always, if you have any questions or need any help implementing SSL or other website security protocols … just ask. We are always happy to help.

Leave your comment
11/6/2020 4:05 AM
The Quran, also romanized Qur'an or Koran, is the central religious text of Islam, believed by Muslims to be a revelation from God. It is widely regarded as the finest work in classical Arabic literature. It is organized in 114 chapters<a rel="nofollow" href=";">;</a>
12/4/2020 4:20 AM
Quranic Arabic is the type of Arabic where the Quran (the sacred book of Islam) is composed. Quranic Arabic is likewise called old style Arabic. As the Quran was composed as ahead of schedule as the sixth century A.D., the language will be marginally not the same as the Arabic of today for more information visit&#160;&#160;&lt;a href=&quot;&lt;a rel=&quot;nofollow&quot; href=&quot;;&gt;;/a&gt;&quot;&gt;Quran&lt;/a&gt;
12/4/2020 4:21 AM
Quranic Arabic is the type of Arabic where the Quran (the sacred book of Islam) is composed. Quranic Arabic is likewise called old style Arabic. As the Quran was composed as ahead of schedule as the sixth century A.D., the language will be marginally not the same as the Arabic of today for more information visit&nbsp;&nbsp;<a rel="nofollow" href=""></a>
1/20/2021 10:38 AM
Great info! I recently came across your blog and have been reading along. I thought I would leave my first comment. I don’t know what to say except that I have.<a rel="nofollow" href=""></a>
1/20/2021 11:56 AM
&nbsp; You made some good points there. I looked on the internet for the topic and found most persons will go along with with your blog.&nbsp;&nbsp; <a rel="nofollow" href=""></a>
2/21/2021 12:08 AM
Learned lot of About SSL from here, Great Post. I used my&nbsp;<a rel="nofollow" href=""></a> blog for SSL and it get good rank now.
3/30/2021 6:07 AM
Two Stage Evaporative cooler is the latest technology to use the process of cooling through evaporation. The best results so far in evaporative cooling have been achieved through this method. This method comprises two stages as you can guess from the name of the process.&nbsp; <a rel="nofollow" href=""></a>