AnandTech Goes HTTPS: All Encryption, All the Time
by John Campion & Ryan Smith on September 18, 2017 2:25 PM EST- Posted in
- Site Updates
If you’re reading this, then congratulations! You have successfully accessed AnandTech over HTTPS.
I’m pleased to announce that as of this afternoon, all AnandTech pages and websites are now being served over HTTPS, allowing us to offer end-to-end transport encryption throughout the site. This is part of a larger project for us which started with moving the AnandTech Forums over to the XenForo software package and HTTPS last year; now it’s AnandTech main site to receive a security treatment of its own.
This update is being rolled out both to improve the security of the site, and as part of a broader trend in site hosting & delivery. From a site operations point of view, we’ve needed to improve the security of the user login system for some time so that usernames and passwords are better protected, as the two of those items are obviously important. Meanwhile, although AnandTech itself is not sensitive content, the broader trends in website hosting is for all sites regardless of content to move to HTTPS, as end-to-end encryption still enhances user privacy, and that’s always a good thing.
With today’s update, we’re now serving all pages, images, and other local content exclusively over HTTPS. This also includes redirecting any HTTP requests to HTTPS to ensure a secure connection. Overall, the hosting change should be transparent to everyone – depending on your browser, this even eliminates any security warnings – and site performance is virtually identical to before, both on the server side for us and on the client side for you. In other words, a true upgrade in every sense of the word.
However in the unlikely event that you do encounter any issues, please let me know. Leave a note here in the comments, email me, send a tweet, etc. If something is amiss, we want to fix it as quickly as possible.
Finally, I want to quickly thank our long-time developer John Campion, DB guru Ross Whitehead, hosting master Alec Ginsberg, and the rest of the AnandTech/Purch development team for working on this project. While today’s update is transparent at the user level, a lot of work was necessary on the backend to make this as seamless as possible and to make it work with third-party content (ads, JS libraries, etc). So none of this would be possible without their outstanding efforts.
86 Comments
View All Comments
shabby - Monday, September 18, 2017 - link
It's not just a check box feature you turn on and off?Ian Cutress - Monday, September 18, 2017 - link
"While today’s update is transparent at the user level, a lot of work was necessary on the backend to make this as seamless as possible and to make it work with third-party content (ads, JS libraries, etc)."willis936 - Monday, September 18, 2017 - link
I would love to know why it would take a ton of work. I know extremely little about site hosting and was able to get an autorenewing cert through acme easier than I got a php server running.T.Duncan - Monday, September 18, 2017 - link
For a simple site, https is easy. If you have ads or other content coming from other providers or from domains you don't control, then not so much. For a very detailed explanation of the fun that can be had, see https://nickcraver.com/blog/2017/05/22/https-on-st...Ryan Smith - Monday, September 18, 2017 - link
This is the first time I've seen that specific writeup, but yes, that's a rather apt summary of many of the things we had to account for. Local content wasn't too bad; it's the third-party content that made things interesting.Threska - Monday, September 18, 2017 - link
That was the same reason Arstechnica gave for not having HTTPS for non-paying customers.Notmyusualid - Tuesday, September 19, 2017 - link
+47,000.Good link / story.
Samus - Monday, September 18, 2017 - link
Give credit where credit is due, AT is a small operation, even when considering their corporate arm. Most small business websites, especially those with less than 50 employees, and even those running complex databases, are still on HTTP. Most people only switch to HTTPS when implementing eCommerce.FreckledTrout - Monday, September 18, 2017 - link
TomsHardware still hasn't switched to HTTPS which I find rather ironic since they advocate its use and are pretty large tech site. Thanks for switching AT.Wolfpup - Monday, September 18, 2017 - link
Nice! Hey, doesn't hurt.