1. APA-OTS WordPress Multi-Site HTTPS Migration: a Case Study
Jeremy Chinquist
APA-OTS Sept. 2017

2. Questions Addressed:
Why should a WordPress website be migrated to the HTTPS protocol?
How can a WordPress multi-site website be migrated to the HTTPS protocol?
How can this task be accomplished seamlessly…
…without loss of site traffic
…without duplicate content (SEO)
…without loss of site speed
…with avoiding errors and the common pitfalls

4. Impetus Chrome & Firefox draw attention to insecure connections
Search engines will start to penalize insecure websites (Q2 2016)
EU General Data Protection Regulation / EU-Datenschutz-Grundverordnung (EU-DSGVO)
Further reading:

5. Blockers Cost per HTTPS Certificate / domain
Wild card certificates help
Free services such as letsencrypt
Transition project costs

6. Decision APA-OTS makes the transition once
All future websites will be HTTPS only
If a certificate is too expensive for a project, the project does not get greenlighted (APA-OTS Web Development)

7. Questions Addressed
Why should a WordPress website be changed from the HTTP to HTTPS protocol?
How can a WordPress website be changed from the HTTP to HTTPS protocol?
How can this task be accomplished seamlessly?
Without loss of site traffic
Without duplicate content (SEO)
Without loss of site speed

8. Milestones Preparation HTTP only (HTTPS redirects to HTTP)
Load Balancer (optional)
HTTPS Certificate(s) installed
Test site is HTTPS ready
Transition: HTTPS only (HTTP redirects to HTTPS)
Monitoring
Clean-Up

9. Preparation phase Multi-Site instance serves: https://service.ots.at
4 internal Rest-API-only sites
3 internal sites with custom forms & post types
Several unique workflows

10. Preparation phase
Customized checklist based on:
Discussions
How can this task be accomplished seamlessly?
Without loss of site traffic
Without duplicate content (SEO)
Without loss of site speed

11. Preparation phase: discussions
Follow / revise the checklist for APA-OTS needs
Rely on a load balancer
Better flexibility
Improved page load speed
Implement HTTPS certificates first on all sites, then transition
Reduces web-site cross linking issues
Hard-coded protocols can always be updated to HTTPS as needed.
301 redirect HTTPS to HTTP except for

12. Milestone: HTTP only (HTTPS redirects to HTTP)
Redirect all traffic to HTTP via .htaccess
# force HTTP (apache reads as „(A OR B) AND C“ RewriteCond %{HTTPS} on [or] RewriteCond %{ https RewriteCond %{REQUEST_URI} !/robots\.txt
RewriteRule .* [L,NE,R=301]
If some sites should not be forced, consider using wp-config.php

13. Daily reminders Check Google Webmaster Tools daily
Add the HTTPS account now!
Make certain Google reports that crawlers are locked out of HTTPS
Webmaster Tools alerts you if the HTTP site is no longer crawlable
Check Google Analytics daily
If you see a dip in page views, check crawler access
Check sitemaps
All sitemap links should be HTTP
Robots.txt for HTTPS and HTTP point to the HTTP sitemap file!
Take time

14. Milestone: Test site is HTTPS ready
Create a mirror site locally and test
Is the theme HTTPS ready (no hardcoded links in the theme, use the WP core setting)
The blog posts will have HTTP links – this will be done via a DB search / replace in text!
Images will also be HTTP hard-coded. Again, this will be done via DB search / replace.
Record HTTP load times via for comparison later

15. Milestone: Test site is HTTPS ready
The hard way: For each table and domain do Update with REPLACE([column name], ‘
Save all commands in an SQL file
OR you can do it the easy way: In this case the motto is “do the search / replace several times and test, test, test!”

16. Transition: HTTPS only (HTTP redirects to HTTPS)
Backup the site!
Allow yourself a good amount of down time!
Remove the .htaccess code (see earlier slide)
Update website settings for HTTPS
Install
Run database updates or search / replaces
Clear WP-Super-Cache (or other caching)
Verify robots.txt is loading properly for both HTTP and HTTPS!
Force your sitemap to update (and verify it uses https)
Switch cron-job entries to HTTPS
If some sites should not be forced, consider using wp-config.php

17. Daily reminders Check Google Webmaster Tools daily
Force the HTTPS site to get the robots.txt file that allows it access
Force the HTTP site to get the robots.txt file that denies it access
Make certain Google reports that crawlers are locked out of HTTP but allowed HTTPS
Webmaster Tools alerts you if the HTTPS site is no longer crawlable
Check Google Analytics daily
If you see a dip in page views, check crawler access

18. Daily reminders Check sitemaps All sitemap links should be HTTPS
Robots.txt for HTTPS and HTTP point to the HTTPS sitemap file
Webmaster tools will report indexing of the HTTPS site
This can take a few weeks
The HTTP site will go down slower than the HTTPS site indexes
Google searches will start to yield HTTPS entries
Use

19. Milestones » Clean-up
APA-OTS had more pages indexed by Google after the transition
We cleaned up a few items
The load balancer transition made for better page-load times
Throw away your back-up site files – you won’t be needing them ever again ;-)

20. Thank you for your attention!
Jeremy Chinquist
@apaots