How To Force HTTP to HTTPS

[Skhilled]

First, you must have a SSL certificate installed! I highly suggest Let's Encrypt...it's free!!! If your hosting does not already have it installed ask them to install it.

https://letsencrypt.org/

Even if you have a SSL installed, you and your visitors can still view the HTTP part of your site. To prevent this you can create a .htaccess file and put it in your root directory where your domain resides. You should add the following code to it:

Code: [Select]

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
If you already have a .htaccess file you'll want to add ONLY the 2nd and 3rd lines directly after the first instance of:

Code: [Select]

RewriteEngine On
This will force all pages of your site to use HTTPS instead of HTTP. 

[Ken.]

How do we determine if our host has the SSL certificate is installed?

[Skhilled]

Look in cPanel. It should be somewhere near the SSL icon.

[Ken.]

Look in cPanel. It should be somewhere near the SSL icon.

Got it.

[Ken.]

Getting ready to add the code to my .htaccess file now.

[Skhilled]

Great! 

[Ken.]

Quick and easy!
Thanks for this new and useful tip Steve. 

[Skhilled]

Remember, that images, etc. may be linked from elsewhere that is not using secured SSL. Also, images should be hosted on the same server.

I found this modified version of repair_settings.php and change all links to https! I found the code fix on SMF:

https://www.simplemachines.org/community/index.php?topic=550197.msg3901127#msg3901127

EDIT: Almost forgot... They are working on a newer version of repair_settings.php and v2.0.14 which should address these things...hopefully. Not sure when it'll be released.

[Skhilled]

Yup! I think the modified repair_settings.php did the trick. But, it does help if you do not use an external "unsecured" server for images or files! They show make it so you will not see the green lock and saying the site is secured.


EDIT: Here's how to check your site to see if it's SSL and if there are any errors:


https://www.jitbit.com/sslcheck/


EDIT: A little more info...and I'll make a class on it or something later so all of this info is in one place...


While working on Ken's forum, I noticed that mods and links to them will make pages show as unsecured. If a mod has embedded unsecured links it will show as unsecured. If any links to the mod, such as a gallery, that contains unsecured links embedded in the code or even the link to the creator or the mod's site is unsecured all pages with links to or from the mod will show as unsecured.

[Ken.]

This process seems to be a bit of a can of worms because of the external links that we have on our sites, especially externally linked images.

[Skhilled]

That depends on how you've been doing things on your site. It can be a bit of a process, actually a PITA, for some more than others. But seems to be a necessary evil, atm.

[Skhilled]

I've found a little known setting that may also help. In the admin, under Cookies and Sessions enable:

Force cookies to be secure
(This only applies if you are using HTTPS - don't use otherwise!)

I've enabled it here...

[Ken.]

Good find Steve, lets hope that it helps.

[davejo]

I just did a long post here with 4 very small png attachments and an error came back and said that it couldn't accept anymore attachment as the folder was full.

As you don't have the 'Draft' mod installed I've lost it all now

[Skhilled]

Sorry, Dave! I haven't checked that setting in quite a few years. Last time I checked I probably didn't have a lot of disk space for the hosting at that time. It is fixed.


EDIT: I've tried to install the drafts mod but get an error when trying to use it. I've uninstalled it and will look more into it this weekend.