Push for site-wide https, but all pages in index are http. Should I fight the tide?

[dennis.globalsign]

Hi there,

First Q&A question

So I understand the problems caused by having a few secure pages on a site. A few links to the https version a page and you have duplicate content issues.

While there are several posts here at SEOmoz that talk about the different ways of dealing with this issue with respect to secure pages, the majority of this content assumes that the goal of the SEO is to make sure no duplicate https pages end up in the index.

The posts also suggest that https should only used on log in pages, contact forms, shopping carts, etc."

That's the root of my problem. I'm facing the prospect of switching to https across an entire site. In the light of other https related content I've read, this might seem unecessary or overkill, but there's a vaild reason behind it.

I work for a certificate authority. A company that issues  SSL certificates, the cryptographic files that make the https protocol work. So there's an obvious need our site to "appear" protected, even if no sensitive data is being moved through the pages. The stronger push, however, stems from our membership of the Online Trust Alliance. https://otalliance.org/

Essentially, in the parts of the internet that deal with SSL and security, there's a push for all sites to utilize HSTS Headers and force sitewide https. Paypal and Bank of America are leading the way in this intiative, and other large retailers/banks/etc. will no doubt follow suit. Regardless of what you feel about all that, the reality is that we're looking at future that involves more privacy protection, more SSL, and more https.

The bottom line for me is; I have a site of ~800 pages that I will need to switch to https.

I'm finding it difficult to map the tips and tricks for keeping the odd pesky https page out of the index, to what amounts to a sitewide migratiion.

So, here are a few general questions.

• What are the major considerations for such a switch?
• Are there any less obvious pitfalls lurking?
• Should I even consider trying to maintain an index of http pages, or should I start work on replacing (or have googlebot replace) the old pages with https versions?
• Is that something that can be done with canonicalization? or would something at the server level be necessary?
• How is that going to affect my page authority in general?
• What obvious questions am I not asking?

Sorry to be so longwinded, but this is a tricky one for me, and I want to be sure I'm giving as much pertinent information as possible.

Any input will be very much appreciated.

Thanks,

Dennis

[G-Force]

Hi Dennis Lees,

I had to deal with something similar in the past, the website was about online donations and wanted to look secure.

All pages were 301 redirected to the https version and it didn't seem to affect their rankings.

If you are to force sitewide https, I suggest to 301 redirect all http pages to their https version and search engine spiders will do their jobs at crawling the new urls and replacing them in the search results.

Don't expect this to happen overnight! It will take some time, you might see some rankings greatly fluctuate, but things should get back to normal and definitely better than having duplicate content all over the place.

Best regards,
Guillaume Voyer.