Timeline of HTTPS adoption
This timeline gives a history of HTTPS usage and adoption, describing the gradual increase in websites and clients using HTTPS. HTTPS is a secure, encrypted version of HTTP and has been implemented using Sockets Layer (SSL) and Transport Layer Security (TLS). The timeline spans the period from 1994, when HTTPS and SSL were first introduced on Netscape Navigator, to 2019, by which time HTTPS is uniquitous and accounts for more traffic than plain, unencrypted HTTP.
- What were the major protocols related to HTTPS and when were they defined? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says "Standard")
- When did various leading news sites migrate to HTTPS, and what challenges did they face while migrating? (Sort the Full timeline by "Entity type" and look for the group of rows for which this says" Website"; scan the "Entity name" column to find the news websites or other sites of interest to you; then read the "Details" column and look at the cited reference)
- How can we get quantitative data on how many sites and how much traffic uses HTTPS? (Sort the Full timeline by "Entity type" and look for the rows for which this says "Report" or "Report/Observatory")
Entity types and qualitative details
HTTPS is an end-to-end protocol. Therefore, it need only be supported by the browser (on the client side) and the server (it could be terminated at the load balancer or proxy or dealt with directly by the process serving the content).
Other intermediaries, like Internet Service Providers (ISPs), routers, networking services, etc. do not need to be upgraded to support HTTPS. The main effects on them from the transition to HTTPS are: (a) the ability of their packet analyzers to sniff traffic reduces, and (b) the volume of traffic they deal with goes up a little bit.
|Entity type||Broad classification||Top entity names||Typical stages||Details|
|Standard||--||This includes standards around client-server communication for HTTPS. Most of these are published by the Internet Engineering Task Force (IETF).|
|Browser||Client-side||Chrome, Firefox, Netscape Navigator||Security warning||Beyond initial HTTPS support (which was present in most browsers from the get-go), the main browser evolution has centered around the way security warnings are presented around HTTP versus HTTPS, mixed content, and problems with HTTPS certificates.|
|Browser extension||Client-side||Firesheep, HTTPS Everywhere||Vulnerability exploit, security improvement||Browser extensions have played some role in identifying and protecting against vulnerabilities of unencrypted (plain HTTP) connections.|
|Website||Server-side||Lots of websites||HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only||Websites may start by making HTTPS available, so that people who type https:// in the browser will get the HTTPS website. They may then transition to allowing logged-in users to opt-in to HTTPS-only, so that they will see internal links in HTTPS only and will automatically be redirected from HTTP to HTTPS. The next step is default HTTPS-only, which means that except for users who explicitly opt out, everybody is redirected to HTTPS (this could come in two stages: first rolled out to logged-in users only, then to all). Finally, the HTTPS-only stage is when access over plain HTTP is no longer supported.|
|Webmail||Server-side||Gmail, Hotmail, Yahoo! Mail||HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only||Similar to the stages for website. However, webmail is generally more sensitive, so the importance of switching to HTTPS is higher, and webmail services switched to HTTPS before websites.|
|Search engine||Server-side||Google Search, Bing, Yahoo! Search||HTTPS available, opt-in HTTPS-only, default HTTPS-only, HTTPS-only||Similar to the stages for website. Search engine data is intermediate in sensitivity between websites and webmail, and in terms of the chronological evolution also moved to HTTPS somewhere in between.|
|Proxy/load balancer||Server-side||Amazon Web Services||Early SSL termination||Load balancers can manage the SSL/TLS certificates and forward only plain HTTP requests to the servers that have to actually respond to the request.|
|CDN||Server-side||Amazon CloudFront||Custom SSL||Content delivery networks are used to serve static content at low latency and low cost around the world. CDNs have evolved to allow customers to upload their own SSL certificates for content.|
|Ecosystem||Server-side||Advertising||Various backend ecosystems that power the technology and monetization of the web, such as advertising, need to support HTTPS in order to complete the transition to HTTPS.|
Time period grouping
|Time period||Qualitative summary of developments|
|1994–2007||During this period, many of the standards related to HTTPS (HTTP over SSL, HTTP over TLS, SNI) are published as RFCs by the Internet Engineering Task Force. Certificate authorities (CAs) come into being and the CA/Browser Forum is created. A few sites, generally those related to e-commerce, start using HTTPS.|
|2008–2012||The move to HTTPS begins, with Google taking the lead, and Twitter and Facebook following. Webmail moves first, then search for logged-in users. The general playbook is: HTTPS available, opt-in HTTPS-only, then default HTTPS-only.|
|2013–2014||The move to HTTPS continues, with laggers in webmail and search catching up on encryption, and Google beginning encryption even for non-logged-in users. Toward the end of this period, Google begins aggressively pushing for the whole web to go HTTPS, first by stating that HTTPS will be a search ranking signal, then by declaring that Chrome eventually intends to mark all plain HTTP sites as not secure.|
|2015–2017||This is the period when the move to HTTPS intensifies among a number of ordinary websites. Wikipedia, Wordpress.com (?), Reddit, Imgur, and some major newspapers and magazines like the New York Times, The Guardian, TechCrunch, and Wired go HTTPS. Chrome begins the process of marking plain HTTP sites as Not Secure. Let's Encrypt makes it easy and free for people to move to HTTPS. Google and others set up systematic tracking of the proportion of HTTPS usage, and the period ends with a significant increase in HTTPS use. This period also begins a trend of the Chinese government censoring entire websites after they transition to HTTPS, because it can no longer identify and block individual webpages due to encryption.|
|2018–2019||With Chrome now marking all plain HTTP sites as not secure, most high-traffic sites that had not yet migrated to HTTPS complete their migration. This includes sites like IMDb, BBC, Wikia/Fandom, Fox News, and many others.|
|Year||Month and date (if available)||Entity type||Entity name||Stage||Details|
|1994||Standard||SSL v1.0||Protocol||Netscape Communications creates HTTPS for its Netscape Navigator web browser, originally for use with the Secure Sockets Layer (SSL) protocol (SSL version 1.0). Due to security issues, this is never officially published. See w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0.|
|1995||February||Standard||SSL v2.0||Protocol||SSL v2.0 is released. It has a number of security flaws. See w:Transport Layer Security#SSL_1.0.2C_2.0_and_3.0.|
|1995||July||Server hosting||Netscape||Commercial offering||Fortune reports that Netscape charges $1,495 for a server and $5,000 for a server with secure communication (i.e., serving traffic over HTTPS).|
|1995||September 19||Bugfix||Vulnerability exploit||Two graduate students at the University of California, Berkeley discover a security vulnerability with Netscape Navigator, that also affects HTTPS sites and risks credit card transactions being eavesdropped on.|
|1996||Standard||SSL v3.0||Protocol||SSL v3.0 is released and its specification is drafted. IETF would publish this draft as a historical document in 2011.|
|1999||January||Standard||TLS 1.0||Protocol||Version 1.0 of the Transport Layer Security (TLS) protocol is published as RFC 2246. TLS would replace SSL as the protocol used for HTTPS.|
|2000||May||Standard||HTTP over TLS||Protocol||RFC 2818 of the Internet Engineering Task Force (IETF) describes the standard for HTTPS, using HTTP over Transport Layer Security (TLS).|
|2003||June||Standard||SNI||Protocol||RFS 3546 of the IETF describes a number of augmentations to TLS, including Server Name Indication (SNI).|
|2004||April 1||Webmail||Google (Gmail)||HTTPS availability||Gmail, Google's web-based email service, launches. The service is available over HTTPS right from the time of launch.|
|2004||April 14||Bugfix||Vulnerability exploit||Microsoft issues a fix for a bug in its SSL library that allows remote attackers to gain control of unpatched Windows 2000 and Windows NT4 servers offering encrypted services over the internet.|
|2005||April 20||A blog post by Microsoft argues that using non-HTTPS login pages is insecure, even if the form submission is to a HTTPS page.|
|2005||The CA/Browser Forum is founded. It is a voluntary consortium of certification authorities, vendors of Internet browser software, operating systems, and other PKI-enabled applications that promulgates industry guidelines governing the issuance and management of X.509 v.3 digital certificates that chain to a trust anchor embedded in such applications.|
|2006||April||Standard||TLS 1.1||Protocol||RFC 4346 defines TLS 1.1, the next version of TLS after TLS 1.0.|
|2008||July 24||Webmail||Google (Gmail)||Opt-in HTTPS-only||Google adds a setting in Gmail for users to always use HTTPS. Even before this, users could (since the inception of Gmail) access it securely by explicitly typing https:// in the browser. With the new setting, users who have opted in to it will be redirected from HTTP to HTTPS.|
|2008||August||Standard||TLS 1.2||Protocol||RFC 5246 defines TLS 1.2, the next version of TLS after TLS 1.1.|
|2010||January 12||Webmail||Google (Gmail)||Default HTTPS-only||Google switches all Gmail users to redirect to HTTPS; users can change their setings to not redirect to HTTPS. Previously, the default option for this setting was to not redirect, and users had to explicitly choose the option to redirect HTTP to HTTPS.|
|2010||May 21||Search engine||Google Search||HTTPS availability||Google makes search available on SSL at https://www.google.com. However, on June 25, they announced that they are moving encrypted search to https://encrypted.google.com because of challenges reported by school districts.|
|2010||June 17||Browser extension||HTTPS Everywhere||Security improvement||The Electronic Frontier Foundation and The Tor Project, Inc launch HTTPS Everywhere, a Firefox extension, to make Firefox use HTTPS where possible. The extension would evolve over the coming years. As of 2017, it is supported on Firefox, Chrome, and Opera.|
|2010||June 2||Browser enhancement||SSL False Start||A Google team comprising Adam Langley, Nagendra Modadugu, and Bodo Moeller propose SSL False Start, a client-side only change to reduce one round-trip from the SSL handshake. Despite tests showing that it reduces latency by 30%, the effort would be abandoned in April 2012 because of incompatibility with some servers doing early HTTPS termination.|
|2010||October||Browser extension||Firesheep||Vulnerability exploit||Firesheep, a Firefox browser extension that uses a packet analyzer to intercept unencrypted session cookies over Wi-Fi networks, is released. The extension highlights the need for greater security, both in terms of websites moving to HTTPS (end-to-end security) and improving security of Wi-Fi.|
|2010||October 14||Proxy/load balancer||AWS Elastic Load Balancing||Early SSL termination||AWS Elastic Load Balancing announces support for SSL termination. This means that websites hosted on AWS, behind AWS load balancers, can upload their certificates to the load balancer, and have the load balancer take care of the SSL certificate, so that the servers that receive the actual traffic only have to handle HTTP traffic.|
|2010||November 3||Website||GitHub||Default HTTPS-only||In response to the release of Firesheep, GitHub moves to HTTPS for all users; previously full-session SSL was only available to paying users.|
|2010||November 9||Webmail||Hotmail (Microsoft)||Opt-in HTTPS-only||Microsoft lets users of its web-based email service, Hotmail, set HTTPS by default.|
|2011||January||Website||Opt-in HTTPS-only||Facebook begins allowing logged-in users to opt in to have all their Facebook browsing encrypted by HTTPS.|
|2011||January||Standard||OCSP stapling||Protocol||RFC 6066, introducing OCSP stapling, is published. OCSP stapling is an alternative approach to the Online Certificate Status Protocol that allows the presenter of a certificate to bear the resource cost involved in providing OCSP responses by appending ("stapling") a time-stamped OCSP response signed by the CA to the initial TLS handshake, eliminating the need for clients to contact the certificate authority. RFC 6961 would cover the case of multiple OCSP stapling.|
|2011||March 15||Website||Opt-in HTTPS-only||Twitter begins allowing logged-in users to opt in to have all their Twitter browsing encrypted by HTTPS.|
|2011||July 15||Proxy/load balancer||Nginx||GlobalSign, DigiCert, Comodo and NGINX Inc. announce a joint effort to add OCSP-stapling support to Nginx.|
|2011||October 18||Search engine||Google Search||Default HTTPS-only||Google makes HTTPS (using SSL) the default option for its search users who are logged in on google.com (its US site; regionally branded sites are not affected). In particular, webmasters receiving traffic from Google Search will no longer be able to know the search terms that led to a specific visit.|
|2012||February 13||Website||Default HTTPS-only||Twitter makes HTTPS the default for all logged-in users.|
|2012||March||Search engine||Google Search||Default HTTPS-only||Google makes secure search the default globally for signed-in users. Previously, the change was limited to users on google.com.|
|2012||July 31||Webmail||Outlook (formerly Hotmail) (Microsoft)||Default HTTPS-only||With the rebranding of Hotmail as Outlook.com, Microsoft moves to default HTTPS-only for all usersof the web-based email service.|
|2012||October 9||Website||Quora||Opt-in HTTPS-only||On or before this date, question-and-answer website Quora allows logged-in users to opt in to HTTPS-only.|
|2012||November||Website||Default HTTPS-only||Facebook rolls out its transition to HTTPS by default for all users, beginning with North America. The move is reported to be completed on August 1, 2013.|
|2012||November 19||Standard||RFC 6797||Default HTTPS-only||The HTTP Strict Transport Security (HSTS) standard is published, after being approved on October 2. The standard allows a website to set a header specifying a time period over which the client must connect to the website only via HTTPS. This protects against protocol downgrade attacks and cookie hijacking, and also avoids the extra latency involved in redirecting HTTP to HTTPS.|
|2013||February||The Certificate Authority Security Council is founded by the seven largest certificate authorities: Comodo, Symantec, Trend Micro, DigiCert, Entrust, Entrust, GlobalSign, and GoDaddy.|
|2013||August 21 (actual release), August 1 (announcement)||Website||Wikipedia||Default HTTPS-only||Wikimedia Foundation turns on HTTPS for all logged-in users (announcement August 1).|
|2013||September||Search engine||Google Search||Default HTTPS-only||Google Search moves all searches, even those by users who are not logged in, to HTTPS. The only exception is ad clicks. The change is believed to be a response to concerns about privacy triggered by relevations about PRISM, a United States federal government surveillance program.|
|2013||September 26||Website||Imgur||HTTPS available||Image-hosting service Imgur makes HTTPS available sitewide.|
|2013||October 14||Webmail||Yahoo!||Default HTTPS-only||Yahoo! Mail moves to a default of HTTPS-only.|
|2013||October 24, 25||Website||Internet Archive||Default HTTPS-only||The Internet Archive announces that its websites archive.org (which includes the Wayback Machine at web.archive.org) and openlibrary.org are defaulted to HTTPS-only, though they will still be available over HTTP.|
|2014||January 22||Search engine||Yahoo!||Default HTTPS-only||Yahoo! Search makes HTTPS-only the default. The change is initially rolled out on yahoo.com, but is expected to be rolled out to other regions as well.|
|2014||January||Website||YouTube||Some move to HTTPS||YouTube begins sending traffic over HTTPS, significantly increasing the volume of traffic sent on the web via HTTPS. By September 2014, 50% of YouTube traffic would be sent via HTTPS.|
|2014||February 3||Website||Tumblr||Opt-in HTTPS-only||Tumblr gives blog owners the option of switching their blogs to HTTPS-only. NOTE: Unlike some other opt-in HTTPS-only implementations, the option is controlled by website owners rather than website visitors. Internet security commentators feel that Tumblr didn't go far enough, and should have switched to default HTTPS-only.|
|2014||March 5||CDN||Amazon CloudFront||SNI custom SSL, HTTPS redirection||Amazon CloudFront announces support for customers to use their own SSL certificates through the implementation of Server Name Indication, as well as HTTP to HTTPS redirection (via 301 redirect).|
|2014||June 5||Website||WordPress||Default HTTPS-only||Automattic, the parent company of wordpress.com, announces that all wordpress.com subdomains will be moved to default HTTPS-only by the end of 2014.|
|2014||July 29||App||Default HTTPS-only||In response to reports about a zero-day security vulnerability, Instagram co-founder Mike Krieger reveals that the app is being moved over to HTTPS, with some parts of the app already 100% HTTPS.|
|2014||August 6||Search ranking||Google Search||HTTPS boost||Google announces search results will give preference to sites using HTTPS. This added ranking signal would be a "lightweight" ranking boost.|
|2014||September 8||Website||Opt-in HTTPS-only||Reddit gives logged-in users the option of using the site purely on HTTPS.|
|2014||November 18||Certificate authority||Let's Encrypt||Free HTTPS certificates||Let's Encrypt, a certificate authority service that can issue HTTPS certificates for three months for free (with some limitations on the types of certificate and the conditions under which certificates can be issued), is publicly announced. The service would issue its first certificate on September 14, 2015, and leave beta on April 12, 2016.|
|2014||December 18||Browser||Chrome||Security warning||Google Chrome announces its intention of adding warnings for users visiting non-HTTPS websites. More details are announced in late January 2015.|
|2015||January 18||Report/Observatory||HTTPSWatch||State of HTTPS adoption||The oldest Internet Archive snapshot of HTTPSWatch appears to be on this date. The snapshot says that it is inspired by Alex Gaynor's blog posts that were published in November and December 2014, so it is likely to be pretty close to the actual start date.|
|2015||February||Browser||Chrome||HTTP/2||Chrome begins rolling out support for HTTP/2. Chrome supports HTTP/2 only over HTTPS, even though the standard allows for HTTP/2 outside of HTTPS (through the selective use of encryption).|
|2015||March 12||Website/App||Default HTTPS-only||Pinterest announces that it has moved over to HTTPS, describing the challenges it faced along the way. With the increased security in place due to HTTPS, Pinterest also introduces a paid bug bounty program for the white hat hacker community to find security flaws.|
|2015||March 25||Ecosystem||Advertising||Exhortation||Writing for the Interactive Advertising Bureau (IAB), Brendan Riordan-Butterworth calls for the advertising ecosystem to move to HTTPS.|
|2015||April 13||Browser||Firefox||Security warning||Mozilla announces plans to deprecate plain HTTP in their browser, Firefox.|
|2015||May 19||Website||Wikipedia||Site-wide censorship due to HTTPS transition||Likely starting around this day (judging from traffic volume), the Chinese government blocks Chinese Wikipedia. The rationale is that, with Wikipedia's coming transition to HTTPS-only, the Chinese government will not be able to identify what page on the site a user is visiting, so blocking the whole site is the only way to implement the goal of blocking specific pages with politically sensitive content. See w:Censorship of Wikipedia#China for more details.|
|2015||June 8||Website||United States government||Default HTTPS-only||The White House Office of Management and Budget issues the HTTPS-Only Standard directive requiring that all United States federal government websites provide service only via HTTPS, with a deadline of end of 2016.|
|2015||June 12||Website||Wikipedia||Default HTTPS-only||The Wikimedia Foundation publishes a blog post stating that all properties (including Wikipedia) are being switched over to HTTPS; previously, HTTPS was used only for logged-in users. It seems the switch is being made immediately.|
|2015||June||Search engine||Bing||Default HTTPS-only||Microsoft announces that it will make HTTPS-only the default on Bing, its search engine.|
|2015||June||Website||Default HTTPS-only||Reddit switches to HTTPS-only, with users being automatically redirected from HTTP to HTTPS.|
|2015||June 30 (deadline), April 17 (announcement)||Ad network||Google AdWords||HTTPS availability||As part of Google's HTTPS Everywhere initiative, Google AdWords announces, on April 17, some of it progress already made on moving ads to HTTPS (specifically, moving YouTube ads to HTTPS). Also, it is stated that the vast majority of mobile, video, and desktop display ads served to the Google Display Network, AdMob and DoubleClick publishers will be encrypted by June 30, and advertisers using any of the buying platforms, including AdWords and DoubleClick, will be able to serve HTTPS-encrypted display ads to all HTTPS-enabled inventory.|
|2015||October 14||Browser||Chrome||Mixed-content||With version 46, Chrome kills off its HTTP-HTTPS "mixed-content" address bar warning. Now, HTTPS pages that load some auxiliary resources (such as images, calls to ad networks, etc.) over HTTP will say https in the address bar without the secure lock or green coloring. The change is based on the idea that mixed HTTP-HTTPS is in fact more secure than pure HTTP, and therefore should not appear scarier, and is intended to "encourage site operators to switch to HTTPS sooner rather than later."|
|2016||February||Website||Wikipedia||Referrer policy||The Wikimedia Foundation rolls out an update to the HTTPS meta referrer policy, that reveals the Origin rather than the full path of the referring domain. This means that websites that receive traffic from Wikipedia can once again calculate how much traffic they are receiving from Wikipedia, an ability that was lost in the switch to HTTPS. However, unlike the pre-HTTPS situation, full referral paths are not accessible, so websites cannot know what Wikipedia pages are sending traffic to them. For more, see Research:Wikimedia referrer policy.|
|2016||March 15||Report/Observatory||Google Transparency Report||State of HTTPS adoption||Google announces that it is adding a new section to its Transparency Report to track the progress of HTTPS adoption.|
|2016||March 23||Google provides a list of certificate authorities it does not trust.|
|2016||February||Browser||Baidu Browser||Vulnerability exploit||The Citizen Lab publishes a report noting vulnerabilities in the Baidu Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.|
|2016||March 28||Browser||QQ Browser||Vulnerability exploit||The Citizen Lab publishes a report noting vulnerabilities in the QQ Browser, a popular browser in China, some of which are related to the browser not using HTTPS fully.|
|2016||April 8||Website||WordPress||Default HTTPS-only||Automattic, the owner of WordPress.com, announces that WordPress custom domains will be switched to default HTTPS-only. Previously, HTTPS-only was enabled only on subdomains of wordpress.com.|
|2016||April 28 (first announcement), August 15 (completion)||Website||WIRED||Default HTTPS-only||On April 28, WIRED announces that its website is going HTTPS-only. The article announcing the transition explains the challenges involved in making sure every digital asset loaded on every page is HTTPS. The transition is announced to be complete on August 15.|
|2016||June 14||App store service||Apple||Default HTTPS-only||At the Apple Worldwide Developers Conference, Apple announces that it will require all iOS apps to use HTTPS connections by the end of 2016.|
|2016||June 15||Website||TechCrunch||Default HTTPS-only||Technology new website TechCrunch announces that it has gone HTTPS-only.|
|2016||August 1||Website||YouTube||State of HTTPS adoption||YouTube announces that it serves 97% of traffic over HTTPS.|
|2016||August||Website||Netflix||Default HTTPS-only||Netflix announces that it is adding TLS encryption to all its video streams, and expects to finish the process by year-end.|
|2016||August 25||Report/Observatory||Mozilla||State of HTTPS adoption||Mozilla, the organization that manages the Firefox browser, creates the Mozilla Observatory to track the web and its security. Among other things, this tracks the state of HTTPS adoption.|
|2016||September (completion), November 29 (announcement)||Website||Default HTTPS-only||The Guardian||The Guardian announces that it completed its migration to HTTPS-only about two months ago. The announcement post describes the challenges of the migration, including avoiding negative audience and revenue impacts, and keeping older interactive content working. The migration approach is summarized as: migrate one small audience section to HTTPS, identify the problems and track them, and fix the problems that need to be fixed before the next section migration. Three complementary techniques used: monitoring, decoupling backend and frontend migrations (with backend migrations done first), and usage of early adopters (users could opt in to HTTPS-only before moving to default HTTPS-only). Technical details of the migration are also included in the post.|
|2017||January 10||Website||New York Times||Default HTTPS-only||The New York Times announces that it has made a number of its articles default to HTTPS, including the home page, section and topic pages, and all articles published 2014 or later, and that it plans to make the rest of its site HTTPS as well.|
|2017||January 21||Guideline||American Library Association||HTTPS use guideline||The American Library Association publishes a library privacy checklist approved by its intellectual freedom committee. The checklist mentions HTTPS twice. In priority 1 actions, it includes an action "Ensure all existing security certificates for HTTPS/SSL are valid and create a procedure for revalidating them annually." In priority 2 actions, it includes an action "Utilize HTTPS wherever possible." (Ironically, even as of April 2019, the American Library Association website does not properly support HTTPS, with the HTTPS site redirecting to the HTTP site).|
|2017||January 25||Website||Ars Technica||Default HTTPS-only||Ars Technica announces that it has switched to default HTTPS-only, and explains details of the move.|
|2017||January||Browser||Chrome||Security warning||With version 56, Google Chrome begins marking as "Not Secure" (in the address bar) any webpages collecting sensitive data such as passwords or credit-card information without using HTTPS.|
|2017||January 4||Website||National Public Radio||Default HTTPS-only||National Public Radio announces that it has transitioned most of its webpages and streaming content to HTTPS, and is making sure that any new content is served through HTTPS.|
|2017||January 10||Website||W Magazine||Default HTTPS-only||A post on the Condé Nast technology blog, describes the transition of W Magazine, a Conde Nast property, to HTTPS.|
|2017||March 30||Website||Pornhub||Default HTTPS-only||Pornhub, the world's largest pornographic video site, switches to HTTPS-only. Sister service YouPorn is scheduled to go HTTPS-only on April 4.|
|2017||May 22||Website||Stack Overflow||Default HTTPS-only||Stack Overflow announces that it has migrated to HTTPS, after four years of work on the migration. All other Stack Exchange websites are also moved over to HTTPS.|
|2017||May through August 16||Website||Springer-Verlag||Default HTTPS-only||Publisher Springer transitions its websites to HTTPS, with HTTP redirecting to HTTPS.|
|2017||September 11||The Google Security Blog announces Google Chrome's finalized plans to distrust certificates issued by Symantec. The SSL Store blogs about it with some commentary explaining the controversy.|
|2017||September 13||Website||Imgur||Default HTTPS-only||Image-hosting service Imgur defaults to HTTPS-only for all users (both logged-in and others).|
|2017||October||Browser||Chrome||Security warning||Starting with version 62, Chrome begins marking all non-HTTPS webpages as "Not Secure" for users in incognito mode.|
|2017||Report||Research at Google||State of HTTPS adoption||Research at Google publishes a paper titled Measuring HTTPS adoption on the web.|
|2017||Standard||TLS 1.3||Protocol||The standard for TLS 1.3 is under discussion, but not finalized. Browsers support it for a while as the default but then stop due to issues. See w:Transport Layer Security#TLS_1.3_.28draft.29 for more. As of the end of 2017, TLS 1.3 is still not ready.|
|2018||February 27||Certificate authority||Let's Encrypt||Wildcard support||Let's Encrypt plans to make wildcard support fully available on this date, after launching a public test API endpoint for the ACME v2 protocol and wildcard support on January 4, 2018.|
|2018||April 14||Website||IMDb||Default HTTPS-only||Judging from homepage captures on the Internet Archive's Wayback Machine, this is the date that the IMDb transitions from HTTP to default HTTPS-only. See captures for April 13 and April 14. There does not appear to be any official announcement of the transition, but a Quora question with answers as late as February 2018 confirms that people noticed that the site was still using plain HTTP till February 2018.|
|2018||June (completion), July 9 (announcement)||Website||BBC||Default HTTPS-only||In a blog post on July 9, 2018, software engineer James Donohue announces that the BBC has completed transitioning its website to HTTPS-only a few weeks ago. The blog post explains some of the technical challenges of migrating the site (which has news content from as far back as 1997, when the site first went online), and the steps involved in completing the migration.|
|2018||July (planned date), February 8 (announcement)||Browser||Chrome||Security warning||On February 8, Google Chrome announces that starting with Chrome 68, which will be released in July, all plain HTTP sites will be marked as not secure. The release happens as scheduled. Forbes publishes an article naming a few sites that still do not default to HTTPS as of the time of this change to Chrome. The sites include Fox News, the Los Angeles Times, Chicago Tribune, Time, ESPN, NFL Network, NBA, and more. Some of these sites, such as Time and ESPN, still do not default to HTTPS as of April 2019.|
|2018||August 7||Website||BBC||Site-wide censorship due to HTTPS adoption||The BBC website is blocked in China shortly after it migrated to HTTPS-only. For HTTPS websites, it is not possible for intermediaries in the network to identify individual pages being browsed, so the Chinese government needs to block the whole site in order to block access to politically sensitive content.|
|2019||January to February; with some early test efforts in October 2018, and some wrap-up work as late as April 11||Website||Wikia / Fandom||Default HTTPS-only||Fandom Inc., the company previously known as Wikia, moves the bulk of their community wikis from HTTP to HTTPS, while also changing the domain from wikia.com to fandom.com (to be more consistent with the company's new name and branding). Some domains that do not fit with the Fandom brand are moved to wikia.org instead; these are also migrated to HTTPS.|
|2019||August||Browser||Chrome||Interface simplification||With Chrome 76, Google stops showing the leading https and www on urls in the address bar; however, these are shown if you click into the address bar twice. The Chrome team says that this simplifies the experience for most users by removing information that's not relevant to them, but there is some pushback to these claims from people who believe the information is important and should be readily visible. Users can still determine if a site is secure by looking for the lock icon; insecure sites will be marked "Not Secure".|
Meta information on the timeline
How the timeline was built
The initial version of the timeline was written by User:Vipul.
What the timeline is still missing
Timeline update strategy
- Keep pace with the latest developments in HTTPS
- Look for articles about websites and services transitioning to HTTPS
- Use the Wayback Machine to identify dates of transition to HTTPS
- History of HTTPS Usage by Jeff Kaufman
- Sprout, Alison (July 1, 1995). "The rise of Netscape". Retrieved March 11, 2018.
- Kaufman, Jeff (March 8, 2018). "History of HTTPS Usage". Retrieved March 11, 2018.
- "Netscape: Internet security flaw can be fixed.". September 19, 1995. Retrieved March 11, 2018.
- Markoff, John (October 16, 1995). "The New Watchdogs of Digital Commerce". New York Times. Retrieved March 11, 2018.
- "The Secure Sockets Layer (SSL) Protocol Version 3.0". Internet Engineering Task Force. August 1, 2011. Retrieved November 23, 2017.
- "The TLS Protocol Version 1.0". Internet Engineering Task Force. January 1, 1999. Retrieved November 23, 2017.
- "HTTP Over TLS". Internet Engineering Task Force. May 1, 2000. Retrieved November 23, 2017.
- "Transport Layer Security (TLS) Extensions". Internet Engineering Task Force. June 1, 2003. Retrieved November 20, 2017.
- "Microsoft SSL Vulnerability gives attackers opportunity to gain control of leading banking sites". Netcraft. April 14, 2004. Retrieved March 11, 2018.
- "TLS and SSL in the real world". April 20, 2005. Retrieved March 11, 2018.
- "The Transport Layer Security (TLS) Protocol Version 1.1". Internet Engineering Task Force. April 1, 2006. Retrieved November 23, 2017.
- Rideout, Ariel (July 24, 2008). "Making security easier". Google. Retrieved November 19, 2017.
- "The Transport Layer Security (TLS) Protocol Version 1.2". Internet Engineering Task Force. August 1, 2008. Retrieved November 23, 2017.
- Schillace, Sam (January 12, 2010). "Default https access for Gmail". Google. Retrieved November 19, 2017.
- Roseman, Evan (May 21, 2010). "Search more securely with encrypted Google web search". Google Official Blog. Retrieved March 11, 2018.
- Eckersley, Peter (June 17, 2010). "Encrypt the Web with the HTTPS Everywhere Firefox Extension". Electronic Frontier Foundation. Retrieved November 19, 2017.
- "HTTPS Everywhere". Retrieved November 19, 2017.
- "Transport Layer Security (TLS) False Start". Internet Engineering Task Force. June 2, 2010. Retrieved November 19, 2017.
- "SSL FalseStart Performance Results". Chromium blog. May 18, 2011. Retrieved November 19, 2017.
- "Changing HTTPS". Imperial Violet. September 5, 2010. Retrieved November 19, 2017.
- Goodin, Dan (April 12, 2012). "False Start's sad demise: Google abandons noble attempt to make SSL less painful". Retrieved November 19, 2017.
- Barr, Jeff (October 14, 2010). "AWS Elastic Load Balancing: Support for SSL Termination". Amazon Web Services. Retrieved November 19, 2017.
- "GitHub moves to SSL, but remains Firesheepable". Netcraft. November 3, 2010. Retrieved November 20, 2017.
- Mills, Elinor (November 9, 2010). "Microsoft lets Hotmail users set encryption by default. Microsoft adds full-session encryption option to HOtmail and SSL for SkyDrive, Photos, Docs, and Devices pages.". CNet. Retrieved November 20, 2017.
- Peterson, Andrea; Gellman, Barton; Soltani, Ashkan (October 14, 2013). "Yahoo to make SSL encryption the default for Webmail users. Finally.". Retrieved November 20, 2017.
- Constine, Josh (November 18, 2012). "Facebook Could Slow Down A Tiny Bit As It Starts Switching All Users To Secure HTTPS Connections". TechCrunch. Retrieved November 19, 2017.
- "Transport Layer Security (TLS) Extensions: Extension Definitions". January 1, 2011. Retrieved November 19, 2017.
- "The Transport Layer Security (TLS) Multiple Certificate Status Request Extension". June 1, 2013. Retrieved November 19, 2017.
- "Making Twitter more secure: HTTPS". Twitter. March 15, 2011. Retrieved November 19, 2017.
- "GlobalSign, DigiCert and Comodo Collaborate with NGINX to Improve Online Trust through Enhanced Certificate Revocation Checking, sign a Sponsorship Agreement. New version of the popular NGINX web server to support OCSP-stapling". NGINX, Inc. July 15, 2011. Retrieved November 19, 2017.
- "Making search more secure". Google. October 18, 2011. Retrieved November 19, 2017.
- Boulton, Clint (October 18, 2011). "Google Makes HTTPS Encryption Default for Search". eweek. Retrieved November 19, 2017.
- Sullivan, Danny (October 18, 2011). "Google To Begin Encrypting Searches & Outbound Clicks By Default With SSL Search". Search Engine Land. Retrieved November 19, 2017.
- "Making search more secure: Accessing search query data in Google Analytics". October 18, 2011. Retrieved November 19, 2017.
- Sullivan, Danny (October 22, 2011). "Google Puts A Price On Privacy". Retrieved November 19, 2017.
- "Securing your Twitter experience with HTTPS". Twitter. February 13, 2012. Retrieved November 19, 2017.
- "Should All Web Traffic Be Encrypted?". Coding Horror. February 23, 2012. Retrieved November 19, 2017.
- Brinkmann, Martin (February 14, 2012). "Twitter Makes HTTPS Default For Signed In Users". Retrieved November 19, 2017.
- "Bringing more secure search around the globe". March 5, 2012. Retrieved November 19, 2017.
- Cook, Tom (October 9, 2012). "Does Quora support HTTPS? Tom Cook's answer log". Retrieved November 20, 2017.
- Asthana, Shireesh (November 15, 2012). "Platform Updates: Operation Developer Love". Facebook. Retrieved November 19, 2017.
- "Secure browsing by default". August 1, 2013. Retrieved November 20, 2017.
- "HTTP Strict Transport Security (HSTS)". November 19, 2012. Retrieved November 19, 2017.
- Lane, Ryan (August 1, 2013). "The future of HTTPS on Wikimedia projects". Wikimedia Foundation. Retrieved September 25, 2016.
- Eaton, Kit (August 2, 2013). "After NSA's XKeyscore, Wikipedia Switches To Secure HTTPS. The Wikimedia Foundation has announced it's pushing ahead with plans to secure its online systems due to NSA targeting.". Fast Company. Retrieved September 25, 2016.
- Sullivan, Danny (September 23, 2013). "Post-PRISM, Google Confirms Quietly Moving To Make All Searches Secure, Except For Ad Clicks". Retrieved November 20, 2017.
- "100 MILLION UNIQUES, HIGHER UPLOAD LIMITS, AND HTTPS SUPPORT". September 26, 2013. Retrieved November 20, 2017.
- Kahle, Brewster (October 25, 2013). "Reader Privacy at the Internet Archive". Retrieved November 19, 2017.
- Streitfeld, David (October 24, 2013). "Internet Archive Will Shield Visitors". New York Times Bits Blog. Retrieved November 19, 2017.
- Protalinski, Emil (October 25, 2013). "With over 3 million users per day, the Internet Archive switches to HTTPS connections by default". The Next Web. Retrieved November 19, 2017.
- Sullivan, Danny (January 22, 2014). "Yahoo Makes Secure Search The Default". MarketingLand. Retrieved November 20, 2017.
- Naylor, David; Finamore, Alessandro; Leontiadis, Ilias; Grunenberger, Yan; Mellia, Marco; Munafo, Maurizio; Papagiannaki, Konstantina; Steenkiste, Peter. "The Cost of the "S" in HTTPS" (PDF).
- "You can now take extra precaution against hackers and snoops by enabling SSL security on your Tumblr Dashboard.". Tumblr. February 3, 2014. Retrieved April 13, 2019.
- "Tumblr activates SSL, but with a catch. Tumblr blog owners can encrypt all visits to their sites, as long as they opt in. Why didn't Yahoo just make SSL the default setting?". February 3, 2014. Retrieved April 13, 2019.
- Siemenski, Paul (June 5, 2014). "Reset the Net. If we properly encrypt our sites and devices, we can make mass surveillance much more difficult. We'll be serving pages only over SSL for all *.wordpress.com subdomains by the end of the year.". The WordPress.com Blog. Retrieved December 1, 2019.
- "Instagram to use HTTPS following discovery of gaping security hole in iOS app. Security expert warns users should not use the app until a patch is released". The Inquirer. July 29, 2014. Retrieved November 19, 2017.
- "HTTPS as a ranking signal". www.google.com. Retrieved Dec 1, 2014.
- Russell, Jon (August 7, 2014). "Google is now ranking websites with HTTPS higher in its search results". The Next Web. Retrieved November 19, 2017.
- "Hell, It's About Time – reddit now supports full-site HTTPS". Reddit. September 8, 2014. Retrieved November 19, 2017.
- Slegg, Jennifer (December 18, 2014). "Google Chrome Wants to Warn Users Before Visiting All Non-HTTPS Sites". The SEM Post. Retrieved November 20, 2017.
- Slegg, Jennifer (January 28, 2015). "First Look at How Google Chrome Plans to Alert Users to Non-HTTPS Websites". Retrieved November 20, 2017.
- "HTTPSWatch (About section)". Retrieved January 18, 2015.
- Gaynor, Alex (November 12, 2015). "The State of the News and TLS". Retrieved November 20, 2015.
- Gaynor, Alex (December 30, 2014). "The State of the News and TLS: Part II". Retrieved November 20, 2017.
- "Hello HTTP/2, Goodbye SPDY". Chromium. February 9, 2015. Retrieved November 19, 2017.
- Moreno, Paul (March 12, 2015). "Making Pinterest HTTPS". Pinterest Engineering via Medium. Retrieved November 20, 2017.
- Riordan-Butterworth, Brendan (March 25, 2015). "Adopting Encryption: The Need for HTTPS". Interactive Advertising Bureau. Retrieved November 20, 2017.
- Barnes, Richard (April 13, 2015). "Intent to deprecate: Insecure HTTP". Retrieved November 20, 2017.
- "Mozilla Announces Plans to Deprecate HTTP in Firefox". The SEM Post. April 16, 2015. Retrieved November 20, 2017.
- "Aggregate page counts for traffic to Chinese Wikipedia for May 2015". Retrieved April 13, 2019.
- Scott, Tony (June 8, 2015). "Policy to Require Secure Connections across Federal Websites and Web Services" (PDF). Retrieved November 20, 2017.
- Scott, Tony (June 8, 2015). "HTTPS-Everywhere for Government". Obama White House Archives. Retrieved November 20, 2017.
- Williams, Martyn (June 8, 2015). "US to require HTTPS for all government websites. All public sites will be required to use the protocol by the end of 2016". Retrieved November 20, 2017.
- Welinder, Yana; Baranetsky, Victoria; Black, Brandon (June 12, 2015). "Securing access to Wikimedia sites with HTTPS". Wikimedia Foundation. Retrieved September 25, 2016.
- Thomas, Karl (June 15, 2015). "Wikipedia switches to HTTPS by default". WeLiveSecurity. Retrieved September 25, 2016.
- Farivar, Cyrus (June 15, 2015). "Wikipedia goes all-HTTPS, starting immediately. "We believe that the time for HTTPS by default is now."". ArsTechnica. Retrieved September 25, 2016.
- "Bing Moving to Encrypt Search Traffic by Default". Bing. June 15, 2015. Retrieved November 20, 2017.
- Schick, Shane (June 22, 2015). "Microsoft to Make HTTPS a Default Setting for Bing". Retrieved November 20, 2017.
- Lorenzo Franceschi-Bicchierai (June 17, 2015). "Reddit Switches to Encryption By Default. The internet giant will switch to HTTPS by default by the end of the month.". Vice. Retrieved November 19, 2017.
- "reddit will soon only be available over HTTPS (self.redditdev)". Reddit. June 16, 2015. Retrieved November 19, 2017.
- "Ads Take a Step Towards "HTTPS Everywhere"". Google AdWords. April 17, 2015. Retrieved November 20, 2017.
- Anthony, Sebastian (October 14, 2015). "Chrome finally kills off the HTTP-HTTPS "mixed content" warning. Slightly alarming and not wholly useful yellow triangle is being retired.". Retrieved November 20, 2017.
- Whittaker, Zack (October 14, 2015). "Chrome 46 loosens up on HTTPS 'mixed content' warnings. The browser -- known for being a bit overkill -- finally drops its yellow-warning attached to pages with both secure and non-secure content.". Retrieved November 19, 2017.
- "Set an explicit "Origin When Cross-Origin" referer policy via the meta referrer tag". August 18, 2015. Retrieved March 10, 2017.
- "Securing the web, together". Google Security Blog. March 15, 2016. Retrieved November 19, 2017.
- Schwartz, Barry (March 16, 2016). "Google Report On HTTPS Adoption Within Google & The Top Web Sites". Search Engine Roundtable. Retrieved November 19, 2017.
- "Google's Transparency Report to Include HTTPS Adoption Rates". Search Engine Journal. March 25, 2016. Retrieved November 19, 2017.
- Chirgwin, Richard (March 23, 2016). "Google publishes list of Certificate Authorities it doesn't trust. Thawte experiment aims to expose issuers of dodgy creds". The Register. Retrieved November 20, 2017.
- Gillis, Alex (February 26, 2016). "Researchers find privacy problems in popular Baidu browser". Retrieved April 13, 2019.
- Knockel, Jeffrey; Senft, Adam; Deibert, Ron (March 28, 2016). "Privacy and Security Issues in QQ Browser". The Citizen Lab. Retrieved April 13, 2019.
- Barry (April 8, 2016). "HTTPS Everywhere: Encryption for All WordPress.com Sites. We're proud to support a more secure web — now for all custom domains on WordPress.com.". The WordPress.com Blog. Retrieved December 1, 2019.
- Tollman, Zack (April 28, 2016). "WE'RE GOING HTTPS: HERE'S HOW WIRED IS TACKLING A HUGE SECURITY UPGRADE". WIRED. Retrieved February 11, 2018.
- Tollman, Zack (August 15, 2016). "How WIRED Completely Encrypted Itself". Retrieved December 1, 2019.
- Conger, Kate (June 14, 2016). "Apple will require HTTPS connections for iOS apps by the end of 2016". TechCrunch. Retrieved February 11, 2018.
- Wilke, Nicole (June 15, 2016). "TechCrunch has gone HTTPS". Retrieved November 19, 2017.
- "YouTube's road to HTTPS". YouTube. August 1, 2016. Retrieved November 19, 2017.
- "Protecting Netflix Viewing Privacy at Scale". Netflix on Medium. August 8, 2016. Retrieved November 19, 2017.
- "Netflix explains how and why it's switching to HTTPS streaming. Adding encryption increases privacy for viewers -- and for Netflix.". August 9, 2016. Retrieved November 19, 2017.
- King, April (April 25, 2016). "Observatory by Mozilla: Making the Web Safer". Retrieved November 20, 2017.
- Paganini, Pierluigi (August 27, 2016). "Mozilla launched the Observatory tool to test the security of websites". Retrieved November 20, 2017.
- Chauvin, Mariot; Islam, Huma (November 29, 2016). "The Guardian has moved to HTTPS. Discover why and how the Guardian has moved to HTTPS, the secure version of the web protocol that helps to protect user privacy". The Guardian. Retrieved April 13, 2019.
- Konigsburg, Eitan; Wan, Vinessa (January 1, 2010). "HTTPS on NYTimes.com". New York Times Open blog. Retrieved November 19, 2017.
- "Library Privacy Checklist - Overview". American Library Association. January 21, 2017. Retrieved April 13, 2019.
- Hutchinson, Lee (January 25, 2017). "Ars announces HTTPS by default (finally). Doing our part to push the encrypted-by-default vision of the Web.". Ars Technica. Retrieved December 1, 2019.
- Murray, Brock (January 21, 2017). "Google Is Requiring HTTPS for Secure Data in Chrome". Retrieved November 19, 2017.
- Tung, Liam (April 28, 2017). "Google tightens noose on HTTP: Chrome to stick 'Not secure' on pages with search fields. In October, Google will begin phase two of its plan to label all HTTP pages as non-secure.". ZDNet. Retrieved November 15, 2017.
- Faughan, Kate (January 4, 2017). "Update to the HTTPS Transition for Streams and Podcasts". National Public Radio. Retrieved February 11, 2018.
- Colucci, David (July 10, 2017). "Securing W Magazine: Our Migration to HTTPS". Retrieved December 1, 2019.
- Barrett, Brian (March 30, 2017). "THE WORLD'S BIGGEST PORN SITE GOES ALL-IN ON ENCRYPTION". Wired. Retrieved November 9, 2017.
- Garun, Natt (March 30, 2017). "Pornhub now turns on encryption by default". The Verge. Retrieved November 19, 2017.
- Craver, Nick (May 22, 2017). "HTTPS on Stack Overflow: The End of a Long Road". Retrieved November 19, 2017.
- Taylor, Anita (May 22, 2017). "How Stack Overflow Flipped the Switch on HTTPS". Stack Overflow. Retrieved November 19, 2017.
- "360 Link: Springer Transition to https -- effective August 16, 2017". ExLibris Knowledge Center. August 7, 2017. Retrieved February 11, 2017.
- "Switching to HTTPS". Springer Online Service on Freshdesk. September 6, 2017. Retrieved February 11, 2018.
- O'Brien, Devon; Sleevi, Ryan; Whalley, Andrew (September 11, 2017). "Chrome's Plan to Distrust Symantec Certificates". Google Security Blog. Retrieved April 13, 2019.
- "Official: Google Chrome's Plan to Distrust Symantec SSL Certificates The announcement being circulated simply finalizes an agreement from July". The SSL Store. September 13, 2017. Retrieved April 13, 2019.
- "Defaulting to https (01-XX-2015) - Request fulfilled as of 09-13-2017!". January 29, 2015. Retrieved November 20, 2017.
- Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web". Retrieved November 20, 2017.
- Feit, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa. "Measuring HTTPS adoption on the web" (PDF). Retrieved November 20, 2017.
- Sullivan, Nick (December 26, 2017). "Why TLS 1.3 isn't in browsers yet". Cloudflare. Retrieved January 28, 2018.
- Aas, Josh (July 6, 2017). "Wildcard Certificates Coming January 2018". Let's Encrypt. Retrieved January 28, 2018.
- "IMDb, as captured on April 13, 2018". April 13, 2018. Retrieved April 13, 2019.
- "IMDb, as captured on April 14, 2018". April 14, 2018. Retrieved April 13, 2019.
- "Why does IMDB use http and not HTTPS?". Quora. Retrieved April 13, 2019.
- Donohue, James (July 9, 2018). "BBC News on HTTPS". BBC. Retrieved April 13, 2019.
- Schechter, Emily (February 8, 2018). "A secure web is here to stay". Google Security Blog. Retrieved February 11, 2018.
- Lardinois, Frederic (February 8, 2018). "Chrome will soon mark all unencrypted pages as 'not secure'". TechCrunch. Retrieved February 11, 2018.
- Bright, Peter (February 9, 2018). "From July on, Chrome will brand plain old HTTP as "Not secure". The "Not secure" label will go where the padlock would go for an encrypted connection.". ArsTechnica. Retrieved February 11, 2018.
- Murnane, Kevin (July 25, 2018). "Fox News, ESPN And 9 Other Well-Known Websites That Chrome 68 Labels 'Not Secure'". Forbes. Retrieved April 13, 2019.
- "BBC websites blocked in China after security change". August 7, 2018. Retrieved April 13, 2019.
- "Help:Fandom domain migration". Fandom Community Central. Retrieved April 13, 2019.
- Brinkmann, Martin (August 16, 2019). "Chrome 76: no more https or www in address bar". Retrieved December 1, 2019.