SSL and SPDY

February 26, 2014

In my quest for faster response times and page load speed, I’ve been playing around with Google’s SPDY. I finally got around to getting a SSL certificate for this website and installing the latest version of the SPDY module for Nginx.

WordPress, alone, doesn’t really support SSL on all pages out of the box – here are some extra things you probably want to implement.

1. Redirect all non-HTTPS traffic to the HTTPS server. For example, this is what I use:

   server {
     listen 80;
     server_name keita.blog;
     return 301 https://keita.blog$request_uri;
   }
   

2. Use HTTP Strict Transport Security:

   server {
     listen 443 ssl spdy;
     ...
     add_header Strict-Transport-Security "max-age=31536000";
     ...
   }
   

   Using HSTS has the benefit of letting the user agent know that all requests should be using the HTTPS protocol for this domain. This is important because some WordPress plugins and/or themes will prefer to use HTTP, even though the connection is HTTPS. I had a problem with some AJAX functions and Jetpack’s Infinite Scroll.

3. (Optional) Install a HTTPS plugin. Not required, but it might help some problems with non-HTTPS content domains, et cetera.