mrjasongorman

processwire.com over SSL

Recommended Posts

I've noticed that the processwire.com website runs over SSL, but i also noticed that visiting the websites over http still works, and once using the insecure version the links are also relative pointing to non-ssl links.

As a fix there could possibly add an auto redirect to the HTTPS site? This could potentially then take advantage of HTTP/2 speed.

 

 

Share this post


Link to post
Share on other sites
LostKobrakai    4,307

Auto https does have the disadvantage, that as soon as there's some issue with the certificate the site is essentially down, even though it's running fine via http. As processwire.com is mostly running with guest users and mostly there to supply public information I'm not sure it that's worth the hassle to disallow http.

  • Like 2

Share this post


Link to post
Share on other sites
benbyf    498

SSL everywhere. Google is pushing HTTPS sites up in their results now. should we all be using HTTPS? and are you now and how?!

also this was a great wake up call for me: http://shoptalkshow.com/episodes/250-web-security-april-king-alex-sexton/

For me I'm using Digitalocean and Serverpilot and it was a matter of enabling the Let's encrypt script so supppppppper easy (full disclosure, those two links have affliates)

  • Like 3

Share this post


Link to post
Share on other sites
Mont    34

I'm using Rochen Host and have enabled Let's encrypt on my MVS.  Love it!  Took longer to update google's webmaster tools and analytics than enabling my sites to TLS.  

My question is whether I should encourage my existing clients who have EV certs now to switch to Let's Encrypt when they expire?

  • Like 1

Share this post


Link to post
Share on other sites
benbyf    498
On 23/03/2017 at 4:42 PM, Mont said:

My question is whether I should encourage my existing clients who have EV certs now to switch to Let's Encrypt when they expire?

+1

Share this post


Link to post
Share on other sites
On 14/09/2016 at 5:07 PM, LostKobrakai said:

Auto https does have the disadvantage, that as soon as there's some issue with the certificate the site is essentially down, even though it's running fine via http. As processwire.com is mostly running with guest users and mostly there to supply public information I'm not sure it that's worth the hassle to disallow http.

It just seems a shame that the forum auto redirects but the main site doesn't?

Share this post


Link to post
Share on other sites
LostKobrakai    4,307

Yeah, but the forum does (need to) handle with lot's of user data. There it makes sense. On processwire.com I'd imagine besides a handful of people nobody is authenticated or otherwise handling any kind of non public data.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By suntrop
      The last days two new sites went online and both got a SSL certificate installed.
      But one has a HTTP problem, although both are configured the same (seem to be). When I run 
      curl -I -L https://www.example.com/
      (http://bit.ly/2pOdjGj)
      it gets redirected to itself again and again. I had a HTTPS redirect in my .htaaccess but have removed it. The home template was configured to use only HTTPS but is now configured to accept both. If I change that to HTTP only, I get and error.
      The origin must come from PW, because all files not processed by PW don't have the redirect problem.
      I had a look at the /site/assets/cache/ folder but don't know what to delete. And there is a cache table in the DB as well. Don't know either if I can just delete its entries.
      Apache 2.4.18 
      PHP 7.0.11
      PW 3.0.42
      No dedicated cache installed, no cache activated in PW
    • By biotech
      Hello community,
      This is the first time I have enabled SSL with PW powered site so forgive the question.
      Templates are set to HTTP or HTTP so content is being processed. However all the assets do not load correctly eg.
      Failed to load resource: the server responded with a status of 404 (Page Not Found) https://site.com/site/assets/files/1/logo.png  
      Any tips?
      Thank you!
    • By mrkhan

      i have one website in PW working fine
      https://domain.com

      in .htaccess i have un commented bellow to work fine with my SSL
      RewriteCond %{HTTPS} off
      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L]

      now i have one folder in this domain with images & i want to get the images with http not https.
      like when i type
      http://domain.com/images/image1.jpg
      it convert this into
      https://domain.com/images/image1.jpg
      how to make only imags in image foler load with http
      Thanks
    • By benbyf
      HELLO! Is anyone running a http/2 setup in production yet and have any strategies / experiences they can share?
      I'm currently running on Ubuntu with DigitalOcean | nginx with serverpilot.io (and they now offer https/2 support)