Over the past two-plus years, NPR has been hard at work on an effort to secure all of our Internet communications and transactions. While this was a complex, multi-faceted effort that touched everything from the website (www.npr.org) to our mobile apps (NPR News and NPR One), to our API calls to our podcast, video, and stream delivery from distributed networks of producers, it was important work that set the foundation for allowing to do the same with many of the member stations tools.
At the same time, we heard from many of you about concerns with your website's not being secure and the impact that might have on your traffic as your visitors see messages that their private information might not be safe, like with Google Chrome.
The good news is that we are ready to address these concerns by moving all 200 Core Publisher sites to HTTP Secure (HTTPS) and are excited to share what you can expect and what you need to do to make your sites secure!
Securing Core Publisher Sites
You may have noticed over the past four months, that there have been a few more maintenance windows than normal as we took steps to standardized Core Publisher website URLs to www. This was done to both improve Core Publisher site rankings in search results as well as allow for more reliability in caching.
We have also begun implementing Akamai Content Delivery Network (CDN) caching in front of all Core Publisher sites to significantly improve station site speed. Akamai is vital to our effort as it is the infrastructure that will be hosting the Secure Socket Layer (SSL) certifications required to move Core Publisher to secure sites.
Lastly, we have implemented a series of Core Publisher code changes to support the move to HTTPS and are now ready for the last phase - domain updates - but we need your help!
What Do We Need From You?
Our goal is to have all Core Publisher Domains updated by mid-September. Please find the next steps below:
The weekend of August 12th - During a maintenance window last Sunday, for all Core Publisher sites that host DNS through NPR, we moved your domains to Akamai Servers. No action was required by your station. You may have noticed that after the window when you made changes to your posts as an admin there was be a slight delay for TTL (time to live) when the changes appeared on your live site.
Throughout August and early September - If your organization manages your own DNS, you will need to update your DNS records. Instructions will be sent to you individually on how to do this. Please alert your IT department or whoever is listed as your technical representative in whois.net.
September - October - If your organization owns your DNS and does not update your DNS record you will not be HTTPS.
NOTE: We can not move to the last phase of securing all sites until all 200 Core Publisher domains have been updated.