I have just migrated our website to a new server, upon doing this the site is missing background and a bunch of elements. I really know very little about PHP but from my newb diagnose it seems to me it could be in the configuration of that.
The website is - https://amandabernstein.com/
Anything to point me in the direction of resolving this or even diagnosing would be amazing. Server was Cpanel now Plesk.
Thanks in advance.
The problem is that you are trying to load static resources over HTTP when the site is viewed over HTTPS - the browser is triggering a mixed content warning and blocking the resource. Your site is not currently HTTPS-ready.
This isn't specifically about the "migration", but because you are redirecting to HTTPS.
When you move to HTTPS everything else also has to be HTTPS as well - HTTPS everywhere - not just the main target URL you see in the browser's address bar.
You probably have http:// hardcoded in your resource URLs. This needs to be changed to https://.
On modern browsers, you can set the following HTTP response header on the initial response to instruct the browser to automatically upgrade the HTTP request to HTTPS which will avoid this browser warning.
Content-Security-Policy: upgrade-insecure-requests;
For example, you can set this in .htaccess with the following directive:
Header always set Content-Security-Policy "upgrade-insecure-requests;"
But note that this will not upgrade any outbound anchors or help old browsers that don't support this header.
Related
I have an application that is running in PHP. I have a ELB classic load balancer in AWS routing HTTPS requests.
I am trying to get the referer URL (understanding this isn't always present) but when I first load the page I can see it appear but then it immediately disappears. I'm guessing this is because ELB is routing HTTPS to HTTP and the page immediately assumes the current domain is the referer. Buuut, I don't know if this is correct and if it is, how can I fix it?
I've Googled but it hasn't come up with any solutions.
Thanks
REF: https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/x-forwarded-headers.html
Check your headers. If you use the X-Forwarded-Proto header is should pass along the referring protocol (HTTP/HTTPS) with the request. Give that a shot, let us know.
One note, ALB's strip this header out by design to prevent forgery. A NLB doesn't perform header manipulation.
I've a website (domain from godaddy and hosted in hostgator). As I updated the certificates, manually, I can redirect my site to https, but it is always going to http from google search. After searching online, I got to know that Considering Strict-Transport-Security: max-age=15768000 as result of curl -i -L on target domain will work for my need as it will force a browser to open the website in https. But I'm confused about how to implement this to my website.
Can anyone help me on this ?
Not sure this is right for Stack Overflow. Then again it covers so many topics that it doesn't fit nicely in any other Stack Exchange site either. So anyway will attempt to answer.
Redirects.
What do you mean "I can redirect my site to https"? You should redirect your site to https now you've gone through the hassle of setting this up so are you doing it? Or are you able to access both http and https? If so find out how to force https even if the user sets up http.
This is set up with a redirect rule on your web server. Not sure whether you have direct access to your config (e.g. .htaccess file if using Apache) or require your host provider to set this up for you.
Google search
Regarding Google Search, once you have the redirect set up, it will take some time for Google to recognise this and update the links in their search index to show the https version of the pages.
Saying that there are ways you can tell Google about this to hurry up the process:
Do you force a redirect to https? If not Google will decide which site to show (http or https) based on a number of factors.
Do you have a site map and have you updated those links to https?
Do you have a rel="canonical" setting in the HTML of any of your pages and is it set to the https version? This tells Google which is the real version of the page if, for example, you allow both http and https versions of the page (not recommended).
Have you registered the https version of your site with Google Search Console? If so are there any errors in there? You can also kick off a re-index request in here.
Have you set all internal links to be https or, better yet, relative links.
Can you update any external links to be https instead of http.
HTTP Strict Transport Security (HSTS)
This is an advanced topic so really wouldn't recommend it until you understand it more. Basically it's a HTTP Header you send back with your webpage over https to tell web browsers "hey I'm an https-only site. From now on, automatically translate any http requests to https automatically before you even send them to me".
It is a good security addition on top of redirects but crucially it does not replace the need for redirects. Redirects need to be in place first to send it to https, at which point your web server can send the HSTS HTTP Header (and which the browser will cache so it knows to change to HTTPS next time).
To set it up you send a HTTP Header like this (but only over https requests).
Strict-Transport-Security "max-age=16070400"
This can be setup in your webserver, or in your php files or any other way you can send HTTP Headers.
Be aware that this we'll prevent your site being available over http, so if you decide to turn off https for whatever reason, then you've basically blocked you're site for up to the max-age time for any browsers that have cached that setting.
For more information on HSTS see here:
301 Redirect and HSTS in .htaccess
But I really don't think that's what you are looking for here. It tells web browsers (like Google Chrome) to force https and is nothing to do with search engines (like Google Search) as, at present, they ignore this Header.
I have a reverse proxy server F5 standing in front of Apache web server which hosts my application - http://example.net/documents/.
F5 which is my organization reverse proxy server is out of my reach as it is managed by admins and they recently implemented HTTPS for my site which changed my site from HTTP to HTTPS.
All worked good except that my entire site content also got changed to HTTPS including any absolute HTTP external url references which were part of site content also got changed to HTTPS. So, my biggest concern now is to preserve original protocol of my site content(specifically, the external link references like jquery etc. under my site content).
I am confused as to how I can address this as reverse proxy server is not in my reach. Is there anything that can be done on Apache web-server to preserve original protocol of any absolute urls by bypassing reverse proxy server's HTTPS implementation? I am not an expert on this. Please help!
First: You of course should always use https for everything. If you site is accessible through https (through the F5) and you reference js files through http:// many browsers will throw warning about mixed and insecure content. Especially jquery and all other JavaScript modules should perfectly be available through https, so i dont really see an issue here?
Second, no, you wont be able to bypass the content rewrite of the F5 Loadbalancer; You could of course hack something that dynamically concats the urls through javascript or something like that, but that is hacky und subject to fail.
Maybe i could help you better if you give an actual example on where you got a problem with https?
i have a really weird problem on a typo3 site.
The site currently runs on Typo3 4.6.6 (yeah i know we are in the process of upgrading it to 6.2 LTS)
In the backend we have 3 separate pages. The webspace where this site runs was currently upgraded to PHP 5.5. Nothing else has changed (as far as we know)
The problem is that on certain pages we get redirected to a https version of the same page, although the link is a http link.
See for instance here: http://www.phd-cell-signaling.at/home.html
If you open this it loads fine. But as soon as you click on a (http) link on the site, you get redirected to an https version hence the browser doesn't load all the stuff included via http (stylesheets for instance). But when you then delete the "s" from the address bar and hit enter you don't get redirected. And this is something i don't really understand.
And if that'd be a general issue shouldn't the other pages in the same typo3 environment also be affected? Or am i missing something here.
Since I'm not that familiar with typo3 it would be greatly appreciated if somebody could link me in the right direction where the problem could be.
We use realURL for example. But I checked the configuration i found and it doesn't appear to do anything that causes the redirect.
I also checked the typoscript configuration of all the pages in the backend with no success.
Are there any other plugins that might cause something like this?
Any help greatly appreciated.
When you follow a link on the page you posted, then the webserver returns the statuscode 301 (moved permanently) with the new location for that page (which is the requested page with the HTTPS scheme).
When TYPO3 is properly configured for SSL usage for single pages (so a backend user can use "Choose protocol" selectbox in the backend), then it already renders affected links with the proper scheme.
Your problem described can have multiple reasons. Please check the following:
Inspect the .htaccess file in the root directory of the TYPO3 website for any scheme redirects
Check if the webserver itself has configured scheme redirects for that virtual host
Goto the TYPO3 extension manager and search for local installed HTTPS or SSL redirection extensions
I have a site running WordPress on Apache server and I am attempting to provide both HTTP and HTTPS connections via the same site. I want to allow connections over HTTP without forcing a redirect to HTTPS, unless the client is connecting initially via HTTPS then I want all subsequent HTTP requests to be forwarded to HTTPS to avoid issues with CORS and unsecured content warnings.
I am having some trouble turning up results on how to effectively do this with mod_rewrite alone. Most solutions I find try to force the connections to redirect to HTTPS regardless and will not allow an HTTP connection or vice versa. I have tried a few mod rewrite conditions including making use of the referer string but none seem to work thus far. I must be missing something because I feel that this is indeed possible but I and my search engines alone are stumped.
Maybe I'm just doing something wrong or is this kind of functionality beyond Mod_Rewrite?
I was thinking to use a PHP script but was worried it wouldn't work for some static files since WordPress doesn't handle those requests.
Update:
I have made a php script to detect the version. It sets a cookie which expires in 20 seconds from being set, this is read by Mod_Rewrite and if set it redirects the URLs to HTTPS. This works for most of the subsequent requests of an initial HTTPS request. A few URLs seem to be unaffected by it, not sure exactly why as the cookie hasn't expired by the time of these file requests and the particular rules are before the static file bypass rules in the htaccess file. At any rate that was easy enough to fix by setting the file urls to protocol-less versions.
Some third party sites need domains rewritten though, as they serve https from other domains. On that note I don't think this is actually possible without buffering the whole page and actually re-writing the URLs.
It is possible to detect the initial connection but this must be done using Server Side code, like a PHP script. Then using the detection can be done at Mod_Rewrite level.
Add in the WordPress constraint and things get complicated.
WordPress isn't built to facilitate one install with both protocols allowing access to content. So to accomplish this would require a custom plugin using the detection mentioned earlier, and instead of using Mod_Rewrite to direct requests on the server, we have to buffer WordPress output and logically replace/rewrite URLs in the page before they go to the user if and only if the initial connection for the page is in SSL.
There is only one plugin I have found which does something similar to this, however it doesn't do dynamic detection only gives admin/editors a checkbox option to make a page SSL secured. The plugin is called WordPress HTTPS
Dynamic detection and redirection isn't something SSL was meant for anyways, it's either on or off, and most pages need it that way.
I was originally trying to provide both so I could use a self-signed certificate without worrying that users would get the "warning unsecured connection" messages from their browsers by forcing them to use only SSL connections.
So I'll be purchasing a cert or making a custom plugin.
tkausl is right, you don't really need to do mod_rewrite. You should be able to format links without the protocol and it will automagically select for you.
You can see that google does this with their hosted libraries:
<script src="//ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
*Note the lack of http: or https: this will follow the protocol requested by the user.