Over the past two-plus years, NPR has been hard at work on an effort to secure all of our Internet communications and transactions. While this was a complex, multi-faceted effort that touched everything from our website (www.npr.org) to our mobile apps (NPR News and NPR One) to our API calls to our podcast, video, and stream delivery from distributed networks of producers, it was important work that set the foundation to allow us to do the same with many of the tools we provide to Member stations.
At the same time, we heard many of your concerns about your website not being secure and the potential impact that might have on your traffic as your visitors see messages that their private information might not be safe, for example with Google Chrome.
The good news is that we are ready to address these concerns by moving all Core Publisher sites (approximately 200) to HTTP Secure (HTTPS). We are glad to share here what you can expect and what you need to do to make your sites secure.
Securing Core Publisher Sites
You may have noticed over the past four months that there have been a few more maintenance windows than normal, as we took steps to standardize Core Publisher website URLs to www. This was done both to improve Core Publisher site rankings in search results and to allow for more reliability in caching.
We have also begun implementing Akamai Content Delivery Network (CDN) caching in front of all Core Publisher sites to significantly improve station site speed. Akamai is vital to our effort as it is the infrastructure that will be hosting the Secure Socket Layer (SSL) certifications required to move Core Publisher to secure sites.
Lastly, we have implemented a series of Core Publisher code changes to support the move to HTTPS and are now ready for the last phase - domain updates - but we need your help!
What Do We Need From You?
Our goal is to have all Core Publisher Domains updated by mid-September 2018. Please find the next steps below:
- Weekend of August 12th - During a maintenance window last Sunday, for all Core Publisher sites that host DNS through NPR, we moved your domains to Akamai Servers. No action was required by your station. You may have noticed that after the window when you made changes to your posts as an admin there was a slight delay for TTL (time to live) when the changes appeared on your live site.
- August - Mid September - If your organization manages your own DNS, you will need to update your DNS records. Instructions will be sent to you individually on how to do this. Please take the time now to alert your IT department or whoever is listed as your technical representative in whois.net.
- September - October - NPR will be finalizing implementation during this period. If your organization owns your DNS and has not updated your DNS record by the deadlines provided, your site will not be HTTPS.
NOTE: We cannot move to the last phase of securing all sites until all Core Publisher DNS records have been updated.
As always, our team is here to support you along the way. If you have any questions throughout the process, please submit a ticket.
We appreciate your patience and cooperation.