SEO Nɔtsie Ɖe 7: Lɛkɛtɔ

Eyi ne Nɔtsie Ɖe 7 ƒe 13-Nɔtsie SEO Nɔtso. Lɛkɛtɔ nyɛ nɛ fɔfɔ Tsilɛ — eye ɔka nɛ kɔ hɔ kɔtsɔ ayi wɛnitsɔ. Google de HTTPS yɛ nɔtso kɔmɛkɛ ƒe lɛdɔwo fi 2014 kɔ, eye apɔ wòame tɔwɔ bɔ le.

---

Aƒe nyɔnu atsi nɛ lɛkɛtɔ aɖe nɔɔ — "Yɛwɔ SSL, enti yɛ wɛb lɛkɛ." Nɛ bɔbɔkɔ, Google di akɔ ze aɖe lɛkɛtɔ tɔmɛ. Wɛbsite a do lɛkɛtɔ edzi, mɔkɔ me na wɛb lɛkɛ aɖe wɔ tɔsisi SSL ndɔ zeresi lɛdɔwo — nʋnyɔ emoji fɔ.

Fia nyɔnu:	dɔme aɖe	abɔ lɛfɛ	nɔxɔ nyitsɔ
Ʋɔlɔmɔ yo	Ʋɔlɔmɔ ze da fɔlɔ kɔ lɛgbɔ	Hɛ ɖe wɛb lɛkɛ bɔkɔ
Fɔvin bɔ	Yɛntɔwɔdɔ ngɔ	SSL Labs nyɛtɔ
TLS 1.2+	Ʋɔl ɔtɛda fɔ na hɛ	SSL Labs nyɛtɔ
Nyelɔ SHA-1	Kɔ ɖi, wɛb lɛkɛ ha	Tɛdɔ nɔ
SAN bɔ	www eye non-www nyɛ nyɛyɔ	Tɛdɔ nɔ
Autɔ-renewal	Fɔ dɔ aɖe	Let’s Encrypt / provider config

SSL test:

100% = Ʋɔlɔmɔ yo + Fɔvɛlɔmɔ + TLS 1.3 + Ʋɔlɔmɔ pɔlɔmɔ + Autɔ-renew
  0% = Ʋɔlɔmɔ dra vɔdɔ de ɖe

Nɛ yɔ ɔkɔbɔ:

1. Ʋɔlɔmɔ dɔ aɖe nɛ fɔlɔ dɔ nyɔnu — Kɔ afomɔlɔ (Nɔtsie 6) aɖe aɖe 30 ƒe dɔda
2. Fɔvɛlɔmɔ afɔ — Server bo nyɛ mɔ fɔ ɖa mɔ kɔ yɔ
3. Mixed content — HTTPS aɖe kɔ HTTP dɔlɔmɔ fɔ (ɔmɔ, aɖe, tɛtɛ)
4. Redirect loops — HTTP → HTTPS → HTTP kɔ gɔ mɔ
5. Non-www vs www kɔ afɔ — Ʋɔlɔmɔ bo a fɔ a, dɔ tɛmɔ lɛ ebi gɔ

Mekɔ bokɔ: Kɔ hebɔmɔ SSL Labs (ssllabs.com/ssltest). Nɛ nɛ dɔ "A" a lo o Meri na ebi egbɔ. Aɖe provider bɔ tɔkɔ lɛ fɔ ɖe kɔɔ.

Lɛkɛtɔ Edzi

Lɛkɛtɔ edzi nye HTTP edzi lɛ anɔ yɔrɛ aɖɔ ahe. Wɔ agboglaalo le rɔtsɔtɔwɔ hɛ — Google nsinye hɔ tɔsisi nɔnu be enwɛ o.

Lɛkɛtɔ edzi tɔ aɖe:

Content-Security-Policy (CSP)

CSP nye lɛtɔ edzi tɔ alede. Emaa nyɔlɔ hɛn fɔfɛ aɖe (aɖɔ, tɛtɛ, ɔmɔ, aasɔlɔ) a nyɔ hɛn lɛ.

Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.example.com; frame-ancestors 'none';

Dɛn CSP bɔ:

• Cross-site scripting (XSS) ɓɔ
• Data injection ɓɔ
• Clickjacking (via frame-ancestors)
• Únɔla script nsiyɔ (cryptominers, ad injectors)

CSP efri bɔko:

1. Gbegbɔ Content-Security-Policy-Report-Only (na aɖe hɛn fɔlɔ)
2. Bɔkɔ wɔ reports lá azɔtɔ 1-2 ƒelɔ
3. Hɔxɔ wɛn nɔni
4. Switch wɔ enforcing mode
5. Kɔ report-uri matou wèi reportiɖi hɛn nɔ

X-Frame-Options

Lɛkɛtɔ aɖɔ aɖe fa wɛb lɛkɛ me gɔn gwo ahe (clickjacking lɛ ɔ).

X-Frame-Options: DENY

Or si wɛb lɛkɛ fɔlɔn mi mɔ gɔn ɖe:

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

Mɔ lɛ ahe aɖe kɔnwɔ update (interpreting files tɔna mɛdzɛu).

X-Content-Type-Options: nosniff

Eyi bɔ le eŋhɔdɔ ahe a .jpg file a tso ahe ahe a browser hɛn tɔ nɛ.

Referrer-Policy

Sɔdɔ ɖɔkɛ le, síbɔ ɖɔ ni yɔa gonger ipɔ ahe a yɔrɛ.

Referrer-Policy: strict-origin-when-cross-origin

Eyi yɔa gʋn dɔ kɔ aɖee a same-domain ƒomɔ agɔ a ewu so but bɔ yɔa heec (domain) a cross-domain.

Permissions-Policy

Lɛkɛtɔ awi mai browsers no (camera, microphone, geolocation, etc.) a wɛb.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Dɔ ahe nyɔna a bɔmi to prevent third-party scripts frɛ nua dɓɔ to.

Header implementation example (Next.js):

// next.config.js
module.exports = {
  async headers() {
    return [{
      source: '/(.*)',
      headers: [
        { key: 'X-Content-Type-Options', value: 'nosniff' },
        { key: 'X-Frame-Options', value: 'SAMEORIGIN' },
        { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
        { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
        { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains; preload' },
      ]
    }]
  }
}

Header implementation (Apache .htaccess):

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Header implementation (Nginx):

add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Mekɔ bokɔ: Fa 5 lɛkɛtɔ aɖe si na server configuration. Eyi fa 5 da bɔme ne da ho bɛ dae to.

HSTS Preload

HTTP Strict Transport Security (HSTS) hɛ browser lɔ na malɔ HTTP a de bɛ hesasɛma — gɔkɔ vɔdɔtɔ wɛm.

HSTS header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Lɛkɛtɔ mǎ aɖe:

Directive	Ʋɔdɔ
max-age=31536000	Kɔ lɛ fi kɔ 1 dɔ (ɛdɔ)
includeSubDomains	Bɔ aɖi kɔ subdomain
preload	Tɔ aɖe ai wɛ browser preload list

HSTS preload list:

Dɔ aɖe kɔ HSTS lɛ kɔ. Browsers nyɔ bɛ aɖe lɛ no na ga bɔ HTTPS. Kɔ hstspreload.org de bɛ:

• Sɔkɔ fiawo yɔ HTTPS a wɛn (nɩ HTTP → HTTPS redirect)
• Impossible wɔ gɔtɔ kwekɔ
• Bɔ lɛmekɔ (ɛbadɔ lɔtɔ bi)

Nkɔdo bɔ HSTS preload:

1. Ʋɔlɔmɔ yo HTTPS
2. Redirect gbogbo HTTP kɔ HTTPS (subdomains so)
3. HSTS header ma max-age >= 31536000
4. HSTS header yɛ includeSubDomains
5. HSTS header yɛ ‘preload’
6. All subdomains ɛyɔ sɛ HTTPS

Nkɔdo: Nyɛ preload nɔ subdomains nɛ bɔ a yɛ HTTPS. includeSubDomains durusé kɔ a HTTP only one bɛme be nayi yɛ lɛwɔ.

Mekɔ bokɔ: Sɛ wòlɔ HTTPS wɔ kantite subdomains áyiyá kɔ HSTS header kpɛ submit ɖe hstspreload.org. Ɔndry yɛwɔn hɛ ʋ egbɔ rɔ vãdɛme.

Vɔlɔbɔla Lɛkɛ

Vɔlɔbɔla lɛkɛ a kɔ ahe a kɔ senɛmɔyáló sɔsɔ a jito lɛkɛ mɔfɔ yɔmɔ fɔ.

Vɔlɔbɔla lɛkɛ a hɔɖe:

• Swiss software: WordPress, plugins, JavaScript libraries a wɔdɔ CVEs
• Fa file a wɛ: .env, .git, wp-config.php, database dumps
• Ahe dɔsɔ: Server version headers, debug mode, stack traces
• Default credentials: Admin pages a wɔdɔ bona, default passwords
• Open ports/services: Unnecessary services exposed to the internet
• Injection points: Forms nɔ CSRF gɔmɔ mɔbɔmúnɔ, unvalidated inputs

Ami ausɔ gɔmɔ fa platform:

Platform	Top Ʋɔlɔbɔla	Fix
WordPress	Outdated plugins	Auto-update + WAF
Shopify	Third-party app permissions	Audit app list quarterly
Next.js	Exposed API routes	Auth middleware + rate limiting
Static sites	CDN misconfiguration	Review cache rules
Custom	SQL injection	Parameterized queries

Bɔla frequency:

• Bɔkɔ: Automated surface scan (SSL, headers, exposed files)
• Wɔyɛ: Dependency vulnerability check (npm audit, WordPress plugin scanner)
• Wɔmɔ: Deep scan with authenticated testing
• Ʋɔha ofe: Regression check

Mekɔ bokɔ: Run npm audit (Node.js) anaa check your CMS plugin list fa outdated components. Fi bɔ critical/high severity issues bɛ nɔɔ.

Mixed Content

Mixed content a gɔ a HTTPS a kɔ resources (ɔmɔ, aɖɔ, tɛtɛ, ahe) kie HTTP. Eyi nɔ nɛ kɔ nɛdze ne horoso le.

Ami mixed content:

Type	Ʋɔdɔ	Nzé	Browser Behavior
Active	High	HTTP script, iframe, CSS	Blocked by default
Passive	Medium	HTTP ɔmɔ, video, audio	Loaded with warning

Active mixed content yɔne gɔme alede browsers — entikɔ yɔ a si a dɔ frɛ bo yɛne. Passive mixed content loads bu a fɔkɔ.

Finding mixed content:

1. Open Chrome DevTools → Console
2. Kɔ "Mixed Content" warnings
3. Alternatively, scan with a crawler (Screaming Frog, LANGR)

Nɛ mixed content hɔ yɔ:

• Hardcoded http:// URLs wɔ content (blog posts, product descriptions)
• Third-party widgets loading HTTP resources
• Embedded content (YouTube old embeds, social media widgets)
• CSS background-image fa HTTP URLs
• Fonts loading a HTTP

Nzete mixed content:

<!-- Kɔ de -->
<img src="http://example.com/image.jpg" />

<!-- Kɔ de ke -->
<img src="https://example.com/image.jpg" />

<!-- Kɔ de (protocol-relative, adapts to page protocol) -->
<img src="//example.com/image.jpg" />

Database fix (WordPress):

UPDATE wp_posts SET post_content = REPLACE(post_content, 'http://yourdomain.com', 'https://yourdomain.com');
UPDATE wp_postmeta SET meta_value = REPLACE(meta_value, 'http://yourdomain.com', 'https://yourdomain.com');

Mekɔ bokɔ: Open your homepage in Chrome, أسس F12, check the Console tab for mixed content warnings. Fi bɔ dɔ de de — mɔ ɛfɛga be Google tɔ.

Third-Party Script Risks

Every external script you load is a potential lɛkɛtɔ (eye performance) ahead. Third-party scripts dɔ:

• Be compromised (supply chain attacks)
• Track your users without consent (GDPR violation)
• Slow your site (render-blocking, network latency)
• Break functionality (version updates, outages)
• Inject unwanted content (ad scripts gone wrong)

Audit your third-party scripts:

Script	Necessary?	Risk Level	Alternative
Google Analytics	Often yes	Low	Server-side tracking
Chat widgets	Maybe	Medium	Self-hosted solutions
Social share buttons	Rarely	Medium	Static share links
A/B testing	Sometimes	High	Server-side testing
Retargeting pixels	Business decision	High	First-party data
Font CDNs	Convenient	Low	Self-host fonts

Risk mitigation for essential third-party scripts:

1. Subresource Integrity (SRI): Hash verification prevents tampered scripts from loading

<script src="https://cdn.example.com/lib.js"
        integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxAE+sO0..."
        crossorigin="anonymous"></script>

1. CSP restrictions: Only allow scripts from known domains
2. Sandboxed iframes: Isolate third-party widgets
3. Regular audits: Quarterly review of all external resources
4. Monitoring: Alert on new external domains appearing in your pages

Mekɔ bokɔ: Fa lɛkɛtɔ hɛn