Got SSL by Hostgator, any extra steps?

So Hostgator gave free SSL to all their customers recently. I have 4 sites with them, overnight they were all working when accessed with HTTPS. I didn't have to do anything about it, just overnight it was working.

Out of the 4 sites, I have 2 of them with wordpress and 2 of them just standalone html/php/jquery/css templates.

Now, I'm reading about this a little bit and it seems I do need to take a few steps to make the site fully SSL/HTTPS optimized. One of that is images, I need to change them all to https.

Any tips? What should I be looking at/checking?

checkout whynopaddlock.com it will show you necesary steps you need to make your site fully secure.

phantasma said:

checkout whynopaddlock.com it will show you necesary steps you need to make your site fully secure.

Click to expand...

Thanks dude, that's actually very helpful.

So I'm doing one of my sites now. The analyzer told me I was not forcing HTTPS, and that I should do it. I followed the instructions and did it, and it works.

However I still get errors on the analyzer, such as:

A file with an insecure url of "http://fonts.googleapis.com/css@family=Open+Sans" was loaded on line: 38 of https://site.com/.
This URL will need to be updated to use a secure URL for your padlock to return.

An image with an insecure url of "http://site.com/images/free-sample-red-button.png" was loaded on line: 49 of https://site.com/.
This URL will need to be updated to use a secure URL for your padlock to return.

An image with an insecure url of "http://site.com/images/paypal-credit-cards-visa-mastercard-american-express-discover.png" was loaded on line: 243 of https://site.com/.
This URL will need to be updated to use a secure URL for your padlock to return.

Isn't the Force HTTPS thing supposed to force HTTPS on everything site-wide?

The force https thing is only supposed to force your site to only show secure https pages.

The problem above can be solved by changing the url's to https.

phantasma said:

The force https thing is only supposed to force your site to only show secure https pages.

The problem above can be solved by changing the url's to https.

Click to expand...

Yeah, I figured. Problem is this website has over 100++ pages, and I have to go in each of them and change the links manually. It's going to take hours.

I can't seem find a way to use the htaccess file to force the change to all those images site-wide. Do you know of a way?

On the pages I have fixed and now display the Secured green icon next to the address bar, I still get this error on whynopadlock:

"You currently have TLSv1 enabled.
This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

Should I be worried about this or do anything to fix it? I was gonna look into this later, but since I have you here I figured I ask

Might be worth checking this out https://en-ca.wordpress.org/plugins/ssl-insecure-content-fixer/

SimpleSiteSolutions said:

Might be worth checking this out https://en-ca.wordpress.org/plugins/ssl-insecure-content-fixer/

Click to expand...

Thanks. I'll check it out when I get to doing my wordpress sites.

Right now I'm not doing a wordpress site, and I need to know an answer to a question.

I have these on each file on my site (over 100++ files):

A file with an insecure url of "http://fonts.googleapis.com/css@family=Open+Sans" was loaded on line: 29 of https://site.com/about/.
An image with an insecure url of "http://site.com/images/free-sample-red-button.png" was loaded on line: 40 of https://site.com/about/.
An image with an insecure url of "http://site.com/images/you-dream-it-we-make-it-about-us.jpg" was loaded on line: 103 of https://site.com/about/.
An image with an insecure url of "http://site.com/images/paypal-credit-cards-visa-mastercard-american-express-discover.png" was loaded on line: 124 of https://site.com/about/.

On some pages I have even more.

Now, these prevent my site from getting the Green Secured thing. If I go in and change these to https manually, then I get the secured thing.

My question is simple, is there a slick way for me to force these to be https, or do I need to throw a few hours at this and go in and change them manually on every single page?

Connect to Cloudflare and activate "Automatic HTTPS Rewrites". Done.

Automatic HTTPS Rewrites eliminate mixed content issues, while enhancing performance and security; it achieves this by rewriting insecure URLs dynamically from known (secure) hosts to their secure counterpart. Automatic HTTPS Rewrites forces a secure connection and enables the latest security standards and features only available over HTTPS

Scorpion Ghost said:

Yeah, I figured. Problem is this website has over 100++ pages, and I have to go in each of them and change the links manually. It's going to take hours.

I can't seem find a way to use the htaccess file to force the change to all those images site-wide. Do you know of a way?

Click to expand...

Forcing https using .htaccess means that every time a user goes to your website it will show only the https version. If a website isn't forced to do this then that would mean when someone visits it using a http link the site won't show https. If you're website was ever shared on social media or anywhere else before you installed the ssl certificate this is what would happen. You fix this by forcing https.

You can edit the .htaccess by visiting the root directory on you're website on cpanel. On some websites it doesn't show so you have to change the option to show hidden files. If it still doesn't show you can create a new one and copy paste the code from somewhere (google how to force https with .htacess you will find examples on how to do it).

Scorpion Ghost said:

This version of TLS is being phased out. This warning won't break your padlock, however if you run an eCommerce site, PCI requirements state that TLSv1 must be disabled by June 30, 2018."

Should I be worried about this or do anything to fix it? I was gonna look into this later, but since I have you here I figured I ask

Click to expand...

I think the TLS issue should be resolved on the web host side so you don't have to worry about it.

Scorpion Ghost said:

Yeah, I figured. Problem is this website has over 100++ pages, and I have to go in each of them and change the links manually. It's going to take hours.

My question is simple, is there a slick way for me to force these to be https, or do I need to throw a few hours at this and go in and change them manually on every single page?

Click to expand...

if you're using wordpress or any other CMS you can try searching for relevant plugins to help you with the task, otherwise if its just plain webpages you might have to do it yourself or hire a VA to do it for you.

Edit: I think a solution to this has been mentioned above.

Thanks for your replies.

I have edited my htaccess file and I have forced HTTPS. Whynopadlock shows:

"Force HTTPS
Your webserver is forcing the use of SSL."

That's all good.

But still, a few links on every page on my site are http. They're hard-coded as http. The code I inserted in htaccess to force HTTPS does not do anything to change these, and my pages still show as insecure because of it.

I'm still not sure if I can somehow either do something to have all those links change in their respective files, or to do something to have my site display them as https, even though they're hard-coded as http, or if I have to edit each page manually and make the changes?

So, I'll have to do manual repetitive work for fix this huh?

as above user said use cloudflare, also change wordpress permalinks structure to https: settings>permalinks
modify wp-config.php and add in second line (after <?php):
define('FORCE_SSL', true);
define('FORCE_SSL_ADMIN',true);

and u are done

DanDD said:

as above user said use cloudflare, also change wordpress permalinks structure to https: settings>permalinks
modify wp-config.php and add in second line (after <?php):
define('FORCE_SSL', true);
define('FORCE_SSL_ADMIN',true);

and u are done

Click to expand...

I AM NOT USING WORDPRESS GUYS. Not on the website I'm trying to fix. NOT WORDPRESS NOT WORDPRESS NOT WORDPRESS.

Cloudflare... my SSL was given to me by hostgator, implemented by them, I don't know anything about cloudflare.

Scorpion Ghost said:

I AM NOT USING WORDPRESS GUYS. Not on the website I'm trying to fix. NOT WORDPRESS NOT WORDPRESS NOT WORDPRESS.

Cloudflare... my SSL was given to me by hostgator, implemented by them, I don't know anything about cloudflare.

Click to expand...

Everyone keeps saying Cloudflare but you keep brushing it off. Cloudflare is the easy way. Go do your hours of work.

CLOUDFLARE HAS A BUTTON FOR THIS

SimpleSiteSolutions said:

Everyone keeps saying Cloudflare but you keep brushing it off. Cloudflare is the easy way. Go do your hours of work.

CLOUDFLARE HAS A BUTTON FOR THIS

Click to expand...

You said "connect to cloudflare..."

I'm looking to do a simple thing here, I don't wanna connect to anything. I don't connect to things if I can do it without connecting. I don't install plugins if I can do it without a plugin.

And the other user that mentioned cloudflare was talking about wordpress.

I still don't see how cloudflare would help me. Even if it could, figuring it out would probably take as much time as it would take me to do it manually, and it would be a headache.

I'll take hard work over a headache any day. I'll do it manually and fix it.

Okay, I finished the first site.

whynopaddlock.com was great help. I used it to figure out what I needed to fix and to get the code for forcing HTTPS.

What wasn't forced into HTTPS I went through and changed into https manually. About 200+ pages actually, Most of them had 4 links each that needed to be changed, and a few had about 10-20 links.

All done now. Now I'll do my second site. Smaller site, should be much faster.

Ran into a problem (like always). Adding the code in htaccess to force HTTPS would mess up the formatting on the admin side of the site. I have no idea why. After a bit of research I discovered I can Exclude a directory from having HTTPS forced on it. So I excluded the Admin directory, and it worked!

I also noticed I never excluded /index.php from the URL on this website. Ah, always something missed. So I took care of that in htaccess too. Sweet.

The photo for my logo is a CSS background image. Tried to hide from me. Had a bit of a hard time finding it because there's some jquery or some madness on this site, and so the image is called from a different file, but the name is not there, and... hard to explain... I fixed it

I also had this link be http - http://ajax.googleapis.com/ajax/libs/jquery/2.0.0/jquery.min.js

I accessed the link as http, and I accessed it as https, it displays the exact same code. So I hope changing this to https isn't gonna mess up any functions on my site. We'll see. Everything looks fine for now, at least in terms of formatting/design.

The other pages (about, services, contact us, etc) also needed some manual editing to change some photos from http to https. Done and done!

It's done. Second site SSL'd up the ass. Green, money, good

Now site 3

@phantasma, Fantasma, are you Greek?

I did my 3rd site. This one is wordpress. I fixed it WITHOUT using any plugins. Feels good. I only used the "Better Search Replace" plugin to replace shit in the database, and I removed the plugin when I was done.

I followed this tutorial - https://www.wpbeginner.com/wp-tutorials/how-to-add-ssl-and-https-in-wordpress/

I also used whynopadlock.com and the knowledge I obtained yesterday in implementing this stuff on my other 2 sites.

Now my 4th site. This one may get complicated. The site is wordpress and pretty big in content and photos and files, and the site has been a headache ever since I created it a few years ago.

Scorpion Ghost said:

So Hostgator gave free SSL to all their customers recently.

Click to expand...

Wtf? Just less then 2 weeks ago I paid for SSL through Hostgator for one of my sites. How did you hear of this?

PassiveJ said:

Wtf? Just less then 2 weeks ago I paid for SSL through Hostgator for one of my sites. How did you hear of this?

Click to expand...

Sorry to hear that bro. Look here and read the comments - https://www.hostgator.com/blog/2018-google-chrome-update/

Here's I think happened. Hostgator didn't want to give free SSL, but they realized that EVERYONE was going to leave them becasue of it, so they decided to do it.

Or they was going to do it all along, but they waited until the very very end (first second week of July) in order to get as many people as they can to buy the SSL from them at those high prices they charge.

After I gave my last answer I decided to check my 3rd site, to open each page and each category and each post, and make sure EVERYTHING is in order.

Well, I found problems. Had to change some in-post images. A few images I had to download and self-host, because even though I would make them https and they would display, for some reason when the page loads they would still load in http. They were all gif images. But I had other gif images that didn't cause this problem. Fuck if I know.

Anyway, I fixed it all. Also updated a few posts on the site and fixed a few things here and there. Now I just need to check if any of the plugins are problematic because of the change and then I'm done with it.

Oh shit, I just remembered something. Social Shares are http-specific! So if you had social shares on the http version of your site, on the https version you have nothing. Oh shit, I just remembered that. That was the case 2 or 3 years ago for sure, but I forgot all about it. And I'm looking at the social shares counters on my site, and they have nothing on any social network, and then it hit me. Oh wow, I gotta look into this now.

Scorpion Ghost said:

@phantasma, Fantasma, are you Greek?

Click to expand...

No I'm not.

Why?

Another thing that almost slipped by me. I realized that Force HTTPS was only working on the homepage on my wordpress site. Other pages could still be accessed on HTTP if you entered it in the address bar and pressed enter.

The solution was unexpected. Just changing the positioning of some code in the htaccess file. Weird.

I found it here - https://stackoverflow.com/questions/19168489/https-force-redirect-not-working-in-wordpress

"Change the order of the rules. First redirect to https and then let WP take over all of your requests."

The only reason I even tried it was just because I had nothing to lose. I did not expect this to work.

phantasma said:

No I'm not.

Why?

Click to expand...

Because your username, Phantasma, means Ghost in Greek. Fantasma means ghost. So I thought you might be. Never mind

Scorpion Ghost said:

Because your username, Phantasma, means Ghost in Greek. Fantasma means ghost. So I thought you might be. Never mind

Click to expand...

I was wondering what made you think I was Greek, so it was the username lol

Scorpion Ghost said:

Sorry to hear that bro. Look here and read the comments - https://www.hostgator.com/blog/2018-google-chrome-update/

Here's I think happened. Hostgator didn't want to give free SSL, but they realized that EVERYONE was going to leave them becasue of it, so they decided to do it.

Or they was going to do it all along, but they waited until the very very end (first second week of July) in order to get as many people as they can to buy the SSL from them at those high prices they charge.

Click to expand...

Right, I'll be on to them about that! Robbing barstewards

Have you tried Really Simpls SSL plugin for your wordpress sites?