Your marketing emails
look secure.
The site is HTTPS.
The certificate is valid.
But every link in every email
goes somewhere else first.
To a tracking host
on your own domain,
set up years ago
so the links would look like yours.
links dot your company dot com,
pointed at the email provider.
It records the click
and redirects you on.
And it only ever answered
on plain HTTP,
because adding a certificate
was an extra step
in a settings page
nobody went back to.
Nobody noticed,
because browsers followed the link,
hit the redirect,
and landed on the secure site
in a fraction of a second.
That is changing.
Chrome now tries HTTPS first
for every address you open.
If the site cannot speak it,
the setting called
Always Use Secure Connections
puts a warning page in front of it
and asks the user
whether to continue.
Google has said
that setting becomes the default
for public sites
with Chrome 154,
this October.
Users on Enhanced Safe Browsing
got it in the spring.
So the click from your newsletter
now opens
on a full page
saying the connection is not secure.
Before your logo.
Before your offer.
Most people close the tab.
And your link tracking
records it as a click.
The same assumption
is printed all over the world.
QR codes on packaging.
Links in PDFs and invoices.
Short links on posters,
on a redirect service
that never got a certificate.
You cannot reissue
forty thousand printed boxes.
You can fix the host
they point at.
So go looking now.
Search your templates,
your documents
and your print files
for http colon slash slash.
List every host you find.
Check that each one answers on HTTPS
with a valid certificate,
and turn it on
where it does not.
Include the tracking domains
your email provider set up for you.
The redirect was invisible
because the browser was patient.
It is becoming less patient
with anyone
who never asked it to be.
– Serguey Asael Shinder
Top comments (0)