How to Set Up a Secure Website

A small padlock in the corner of the browser status bar indicates a website is secure.

Secure websites are a requirement for any business intending to collect personal or sensitive data such as Social Security or credit card numbers from visitors. Websites are secured using secure socket layer (SSL) technology, which encrypts the data sent through the browser from the website visitor to the server and back. The encryption protects the data by making it unreadable to anyone intercepting the traffic. Specific configuration varies depending on the operating system on the server and the application hosting the files, but the basic steps are the same.

Instructions

1. Gather information regarding the server the site is hosted on. You will need the website address (hostname) as well as information verifying your identity, such as company name, phone number and address.

2. Purchase a security certificate through a certified vendor. Quite a few vendors are available. Domain hosts may offer these certificates, or they can be purchased through well-known vendors such as Thawte or VeriSign.

3. Configure the computer hosting the web pages to use the assigned security certificate.

4. Set the website to require the use of the https protocol for your choice of either specific pages or all traffic to the website. By default, https traffic uses port 443 to communicate.

5. Access the website using https:// at the beginning of the website address. Verify that your browser indicates the website is secure by locking for a small lock in the browser, usually in the lower right hand corner.

References

• Petri IT: Configure SSL on Your Website in IIS
• SSL.com: What is SSL?
• HowToForge: Secure Websites Using SSL And Certificates

Resources

• Read this Article in Spanish