Announcement

Collapse
No announcement yet.

Checklist for making site use all https

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    Checklist for making site use all https

    Is there a checklist of all the things that need to be done to switch a site from using http / https to using all https? It would seem that adding

    Code:
    # Force HTTPSRewriteEngine on
    RewriteCond %{SERVER_PORT} 80 
    RewriteRule ^(.*)$ https://www.domain.com/$1 [R,L]
    and updating the Domain Settings is not the recommended way to go. It seems this works just fine on one site but not for another.
    Leslie Kirk
    Miva Certified Developer
    Miva Merchant Specialist since 1997
    Previously of Webs Your Way
    (aka Leslie Nord leslienord)

    Email me: [email protected]
    www.lesliekirk.com

    Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

    #2
    Re: Checklist for making site use all https

    Here is a good resource:

    https://www.netblazon.com/blog/migra...miva-site-ssl/

    Also be sure to check canonical tags to make sure they are being output securely and verify you don't have any robots.txt of meta tags preventing indexing of secure pages
    Brennan Heyde
    VP Product
    Miva, Inc.
    [email protected]
    https://www.miva.com

    Comment


      #3
      Re: Checklist for making site use all https

      I wouldn't do the rewrite part solely because if you forgot anything anywhere on the site that issues a redirect to the insecure url, and htaccess redirects you back to secure, that visitor will go into a loop and won't get any content. As long as the store is properly configured to be using all secure url's, 99% of the traffic will be on https as they start clicking, and the pages will end up indexed https so inbound traffic should also be secure.
      David Hubbard
      CIO
      Miva
      [email protected]
      http://www.miva.com

      Comment


        #4
        Re: Checklist for making site use all https

        Originally posted by ILoveHostasaurus View Post
        I wouldn't do the rewrite part solely because if you forgot anything anywhere on the site that issues a redirect to the insecure url, and htaccess redirects you back to secure, that visitor will go into a loop and won't get any content. As long as the store is properly configured to be using all secure url's, 99% of the traffic will be on https as they start clicking, and the pages will end up indexed https so inbound traffic should also be secure.
        So what defines "properly configured"? That has been my question all along. I have one site that has all of Susan's steps implemented and has been humming along without any issues for a year now.
        Leslie Kirk
        Miva Certified Developer
        Miva Merchant Specialist since 1997
        Previously of Webs Your Way
        (aka Leslie Nord leslienord)

        Email me: [email protected]
        www.lesliekirk.com

        Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

        Comment


          #5
          Re: Checklist for making site use all https

          If the store settings have had the URL's adjusted to secure, and the cookie settings adjusted, in Susan's steps 1 and 2, then that is proper. If templates have had hard coded links added to them, instead of using tokens, then that is not recommended and should be rectified, or the links will need to be manually updated to use https. If there is other content on the site like static pages, a blog, etc., then those all need to be modified to use only https links, but things like that are why I don't like the rewrite, because it's not uncommon for a customer to have wordpress installed and set to http and then the store set to https, links between the two, and the rewrite goes in and everything breaks when trying to access the blog.
          David Hubbard
          CIO
          Miva
          [email protected]
          http://www.miva.com

          Comment


            #6
            Re: Checklist for making site use all https

            BTW: Whatever happened to the MivaWiki Idea...or some similar place that great content (like Susan's HTTPS Info) could be reposited for prosperity (and without having to search through the forum, Miva.com, Web, etc.)?
            Bruce Golub
            Phosphor Media - "Your Success is our Business"

            Improve Your Customer Service | Get MORE Customers | Edit CSS/Javascript/HTML Easily | Make Your Site Faster | Get Indexed by Google | Free Modules | Follow Us on Facebook
            phosphormedia.com

            Comment


              #7
              Re: Checklist for making site use all https

              So I have done everything except the redirect and I've discovered that product links using &mvte:product:link; are not secure. How do I fix that?
              Leslie Kirk
              Miva Certified Developer
              Miva Merchant Specialist since 1997
              Previously of Webs Your Way
              (aka Leslie Nord leslienord)

              Email me: [email protected]
              www.lesliekirk.com

              Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

              Comment


                #8
                Re: Checklist for making site use all https

                Under URI Management there are two settings for domain and secure domain. Make both the https version
                Brennan Heyde
                VP Product
                Miva, Inc.
                [email protected]
                https://www.miva.com

                Comment


                  #9
                  Re: Checklist for making site use all https

                  Wouldn't it be prudent to set the product page (and all pages for that matter) to "Force HTTPS" in the off chance someone types in the URL without https:.
                  Bruce Golub
                  Phosphor Media - "Your Success is our Business"

                  Improve Your Customer Service | Get MORE Customers | Edit CSS/Javascript/HTML Easily | Make Your Site Faster | Get Indexed by Google | Free Modules | Follow Us on Facebook
                  phosphormedia.com

                  Comment


                    #10
                    Re: Checklist for making site use all https

                    Originally posted by Brennan View Post
                    Under URI Management there are two settings for domain and secure domain. Make both the https version
                    I tried that can got a popup messages saying I couldn't do that.
                    Leslie Kirk
                    Miva Certified Developer
                    Miva Merchant Specialist since 1997
                    Previously of Webs Your Way
                    (aka Leslie Nord leslienord)

                    Email me: [email protected]
                    www.lesliekirk.com

                    Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

                    Comment


                      #11
                      Re: Checklist for making site use all https

                      Originally posted by Bruce - PhosphorMedia View Post
                      Wouldn't it be prudent to set the product page (and all pages for that matter) to "Force HTTPS" in the off chance someone types in the URL without https:.
                      Have that done too
                      Leslie Kirk
                      Miva Certified Developer
                      Miva Merchant Specialist since 1997
                      Previously of Webs Your Way
                      (aka Leslie Nord leslienord)

                      Email me: [email protected]
                      www.lesliekirk.com

                      Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

                      Comment


                        #12
                        Re: Checklist for making site use all https

                        Originally posted by lesliekirk View Post
                        I tried that can got a popup messages saying I couldn't do that.

                        Here's the message:

                        Non-secure URL prefix must start with 'http://' and end with '/'.
                        Leslie Kirk
                        Miva Certified Developer
                        Miva Merchant Specialist since 1997
                        Previously of Webs Your Way
                        (aka Leslie Nord leslienord)

                        Email me: [email protected]
                        www.lesliekirk.com

                        Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

                        Comment


                          #13
                          Re: Checklist for making site use all https

                          So Leslie, are you saying that with "force https" checked, you can still access the page insecurely? (It may not effect other links and posts on the page, but at least you know where you are starting from.)
                          Bruce Golub
                          Phosphor Media - "Your Success is our Business"

                          Improve Your Customer Service | Get MORE Customers | Edit CSS/Javascript/HTML Easily | Make Your Site Faster | Get Indexed by Google | Free Modules | Follow Us on Facebook
                          phosphormedia.com

                          Comment


                            #14
                            Re: Checklist for making site use all https

                            Originally posted by Bruce - PhosphorMedia View Post
                            So Leslie, are you saying that with "force https" checked, you can still access the page insecurely? (It may not effect other links and posts on the page, but at least you know where you are starting from.)
                            The page is being accessed securing, but the &mvte:product:link; is not secure. I cannot implement the change that Brennan said needed to done.
                            Leslie Kirk
                            Miva Certified Developer
                            Miva Merchant Specialist since 1997
                            Previously of Webs Your Way
                            (aka Leslie Nord leslienord)

                            Email me: [email protected]
                            www.lesliekirk.com

                            Follow me: Twitter | Facebook | FourSquare | Pinterest | Flickr

                            Comment


                              #15
                              Re: Checklist for making site use all https

                              I believe this is a bug...or, at least an unacknowledge set of circumstances. Ran into the same problem here: http://extranet.miva.com/forums/show...duct%3Alink%3B

                              There was never any response. I believe I just dumped using the Product Link, since it was only effecting the CTGY/PROD pages.
                              Bruce Golub
                              Phosphor Media - "Your Success is our Business"

                              Improve Your Customer Service | Get MORE Customers | Edit CSS/Javascript/HTML Easily | Make Your Site Faster | Get Indexed by Google | Free Modules | Follow Us on Facebook
                              phosphormedia.com

                              Comment

                              Working...
                              X