In 2019 we added SSL to our Managed WordPress service.

This article explains what the SSL component of this service actually provides.

What is SSL?

Have you ever noticed that some websites start with "http://" while others start with "https://"? Perhaps you noticed that extra "s" when you were browsing websites that require entering  sensitive information, like when you were paying bills online.

To put it simply, the extra "s" means your connection to that website is secure and encrypted. Any data you enter is safely shared with that website. The technology that powers that little "s" is called SSL, which stands for Secure Sockets Layer.

Managed WordPress SSL

Starting in 2019, we are rolling out Edge SSL to all customers using our Managed WordPress service. There are a number of differences between this type of SSL and regular SSL certificates.

The Edge SSL service is integrated with our Cloudflare caching and perfomance system. So sites must be using Cloudflare for it to work. We set this up by default so in most cases no changes are needed.

With Edge SSL enabled, CloudFlare will talk to your visitors over SSL, but will talk with your web server over non-SSL.

This means that the communication channel is not 100% SSL.  As always it’s broken up into 2 stages:

• Visitor <=> CloudFlare
• CloudFlare <=> Web Server where your site lives

The difference now is that with Edge SSL, the first stage is encrypted. Visitors will see a padlock in the browser.

A plugin called CloudFlare Flexible SSL is installed to make sure Wordpress does not get into a loop.

When is a full SSL certificate recommended?

As part of the communication is not encrypted, for websites that process sensitive data, such as ecommerce shopping sites, a full SSL certificate should be used. This is installed on our web server and gives an end to end encryption, and provides PCI/DSS compliance.

If your site may need to bypass Cloudflare for some reason, then a full SSL certificate would be required for your site to be secure.

The technology used is not supported on very old browsers, so a full SSL certificate is needed for 100% compatability.

Setup of Edge SSL takes 24-48 hours so for sites that need SSL immediately, a full SSL certificate is the answer.