Just installed an SSL for my website and I'm facing 2 issues:
1- https:// isn't added by default, am I supposed to redirect to https:// with .htaccess or did I mess something up during instalaltion
2- I get this message "Your connection to www.MYWEBSITE.com is encrypted using 128-bit encryption. However, this page includes other resources which are not secure. These resources can be viewed by others while in transit....", I check the console for the error logs, all of it is errors from me linking images from my subdomain, my image folder, and an IMGUR image.
Eg: The page at https://www.website.com/forums/ displayed insecure content from http://www.website.com/forums/images/theme/buttons/collapse_thead.gif.
What should I do?
Change the image URL from http to https
This is little tricky. Approach should be:
Check if REFERRER page is using htts://
If yes then redirect http to https for all image, js, css files
Based on above approach following mod_rewrite rules should work:
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^https:// [NC]
RewriteRule \.(jpe?g|gif|bmp|png|css|js)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NC]
It is probably your application generating URLs to the images without HTTPS.
Have a look here how to rewrite all requests to HTTPS: Need to redirect all traffic to https
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
Related
I am trying to redirect my site to always open in HTTPS. I am using CloudFlare and they have a setting to "Always use HTTPS". But there is a page on my website where I do not want to use HTTPS as it opens other websites under an iFrame. And if that page also loads in HTTPS then under iFrame any website whose URL hasn't been mentioned with HTTPS doesn't open. Therefore, for that particular page I want to keep the website to be opened under HTTP.
Things I am doing:
In CloudFlare Crypto settings "Always Use HTTPS" is ON.
Then in my page where I want it to opened under HTTP say surf.php
I am using the following PHP code:
if($_SERVER['HTTP_HOST'] != 'localhost'){
if(isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] == 'on'){
if(!headers_sent()){
header("Status: 301 Moved Permanently");
header(sprintf('Location: http://%s%s',$_SERVER['HTTP_HOST'],$_SERVER['REQUEST_URI']));
exit();
}
}
}
Now the page doesn't open and says "The page isn’t redirecting properly". What should I do? Is there any other method to accomplish this? I want to use HTTPS in whole website so "Always use HTTPS" settings in cloudflare should be ON except just surf.php. What should be the best method here?
It sounds like you are in a redirect loop. Where you have a .htaccess file that forces HTTPS, and then you redirect to HTTP using PHP. Then that new request has all the same rules applied to it so that it gets redirected by .htaccess again to HTTPS, and so on (to infinity)
So I would first make sure your not forcing HTTPS in your .htaccess file. If so you can add a RewriteCond to exclude your URL:
#RewriteEngine On #-- if not included elsewhere
#if HTTPS is not on (then continue)
RewriteCond %{HTTPS} !=on
#add this rule in (if not our page, then redirect to HTTPS)
RewriteCond %{REQUEST_URI} !^/surf\.php$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
When mod rewrite hits a Rewrite condition if it fails (is false) it will disregard the next rewrite rule. So with this in place your PHP code could do it's job, but you can also do this in htaccess alone. Because you will have dependence on the URL in there anyway, I don't see an issue doing it all in the .htaccess file.
This would basically be the opposite of the above except you know the url. Something like this:
#if HTTPS is not on (then continue)
RewriteCond %{HTTPS} !=on
#add this rule in (if not our page, then redirect to HTTPS)
RewriteCond %{REQUEST_URI} !^/surf\.php$
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
#if HTTPS is not off (then continue)
RewriteCond %{HTTPS}!=off
# (if is our page, then redirect to HTTP)
RewriteCond %{REQUEST_URI} ^/surf\.php$
RewriteRule ^(.*)$ http://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
I can't really test this though, but that's the general idea. If HTTPS is no off, and the %{REQUEST_URI} is our page !^/surf.php$ redirect to HTTP... Basically you have to punch a hole through the HTTPS rule and then force http.
I am pretty sure with %{REQUEST_URI} you only have to check if it starts with your URL (minus the host and protocal).
I'll admit I'm a bit rusty with complex HTACCESS rules, spoiled by MVC routers, so this may very well not be 100% correct. But the general idea is sound.
Anyway hope it helps.
Today I just bought SSL certificate from my single domain and it works fine as mydomain.com, but when I select sub domain example city.mydomain.com its not working all page's are look totally different, all my CSS file look very poor, malfunction on page layout. any help with appropriate example will be highly appreciated.
I have more than 70 sub domain
Main domain should be like this >>> https://www.presskr.com
and all sub domain should be like this https://subdomain.presskr.com
Write below rules in your root htaccess file.
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} !=example.com
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
Hope it will help you :)
this will also work
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} =http://www
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
You want to redirect everything to https if I understand. And the page looks strange.
It's a mixed content problem, you need to edit your webpage to change the links of javascript, css and others ressources from http to https.
You can't solve that problem only with a redirect because when the browser see he need to fetch the http js/css/* for the https webpage, he stop because it's insecure. He stops before making the request so the browser is not aware of your redirect.
A temporary fix is to use https://www.w3.org/TR/upgrade-insecure-requests/ but it's not working everywhere http://caniuse.com/#feat=upgradeinsecurerequests
I am trying to force https only on one page of a yii framework website, and let the rest of the pages be http. The page that would be forced https is
https://www.mywebsite.com/index.php?r=user/profile
The following creates what I desire, but with a mixed content error. Furthermore, when I go from the mixed content tab to any other tab, it doesn't automatically become http. It takes the movement to one more tab to reach http status.
RewriteEngine On
# Go to https
RewriteCond %{HTTPS} off
RewriteCond %{QUERY_STRING} ^r=user/profile$ [NC]
RewriteRule ^(index\.php)$ https://www.mywebsite.com/$1 [R,L]
# Go to http
RewriteCond %{HTTPS} on
RewriteCond %{HTTP_REFERER} !/index\.php\?r=user/profile
RewriteCond %{REQUEST_URI} !^/index\.php$ [OR]
RewriteCond %{QUERY_STRING} !^r=user/profile$ [NC]
RewriteRule ^(.*)$ http://www.mywebsite.com/$1 [R,L]
The mixed content error is as follows.
Mixed Content: The page at 'https://www.mywebsite.com/index.php? r=user/profile' was loaded over HTTPS, but requested an insecure image 'http://www.mywebsite.com/assets/7a295fc1/nav1_bg.gif'. This content should also be served over HTTPS.
As it can be seen, the assets under yii framework is the only folder causing problem.
1.Is there a way to request the files used from assets in a https fashion so I don't get a mixed content error?
2.Is there a way to ensure that moving from the https tab to any other tab causes immediate http conversion, instead of requiring the movement to one another tab. (i.e. Profile page(https) to Home page causes a Home page with (https). Movement from the home page to any page other than the profile page becomes (http). I would like it to happen immediately.
The problem is you cant make a http request for any static or dynamic files from an https connection.
The best solution is to Move entire thing in https.
If it is not possible then one other solution would be like this - make a proxy page. that would be receiving https request and fetch the content over http and serve it via https.
I'm using Cloudflare's SSL on Flexible (Free) and it works perfectly fine.
I have setup all files and links from https:// to // to make them work over https.
I have also set the following in my .htaccess file to make any client go from http to https automatically:
RewriteCond %{SERVER_PORT}s ^(443(s)|[0-9]+s)$
RewriteRule ^(.*)$ - [env=askapache:%2]
The issue with the .htaccess code is that it only changes http to https on the root index file of my site for example, http://example.com/index.php will redirect to https but http://example.com/folder/index.php wont.
My second issue is even if I do a simple href="https://example.com/folder/index.php" or href="//example.com/folder/index.php" it will just bring me to the basic http url.
If you are using CloudFlare, you can define to always use SSL in the page rules.
For .htaccess (recursive):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
We have a section of our site which uses https to login securely, however when you visit this page and click away, you continue to view the site in HTTPS. This causes display issues on any pages using the http://www.domain.com/news/ URL.
How can we force all pages under the http://www.domain.com/news/ folder to use HTTP rather than HTTPS?
It's the opposite of requiring https, so with the condition of https on, rewrite this specific dir with deeper path to the http version.
RewriteEngine on
RewriteCond %{HTTPS} on
RewriteRule ^news/(.*) http://%{SERVER_NAME}/news/$1 [L]
Instead of SERVER_NAME, you can use HTTP_HOST when your site is accessed with a server-alias and you don't want to change that.
Be aware that links to https-requiring pages should be use https explicitly, or have a rewrite-rule of their own.
Place this 301 redirect rule in /news/.htaccess:
RewriteEngine on
RewriteBase /news/
RewriteCond %{HTTPS} on
RewriteRule ^ http://%{HTTP_HOST}/%{REQUEST_URI} [L,R=301,NE]