2

I finally set up my first EE site with SSL. Everything seems to be working ok, but I discovered that some of the pages are "delivering unencrypted elements". What I've found so far:

  • Images added through WYSIWYG are being called via http and not https
  • I am using EE_Twitter, and any images through there are also being delivered via http and not https

If I have a page without either of those, then I get a thumbs-up from the browser.

I am utilizing a master config file, and my .htaccess file looks like this:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [L,R=301]

RewriteCond %{HTTPS} on!
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

Any suggestions would be greatly appreciated!

  • 1
    Silly question, but in Admin > General Configuration do you have https addresses in the three URL fields, ensuring that any path variables wind up with https addresses as well? And are you using the native rich text editor? – Jean St-Amand May 20 '14 at 10:44
  • I have it in two (URL too root directory and URL to themes folder). I typically leave the site's index page blank. Bad? And no, I'm not using the native rich text editor. Using WYGWAM. – Todd May 20 '14 at 19:12
  • Did you happen to develop testing with http links and then switch to https at any point? Wondering whether Wygwam stored http links previously. Another note: you can probably get away with using Low Replace to root out lingering http links even though there's almost certainly a cleaner way. – Matt Stein May 20 '14 at 22:21
  • Yes, we worked on it for a while as a "dev." site prior to making the switch. Great idea - I'll look through and see if there are any http links. Any thoughts on how to fix the Twitter part? – Todd May 21 '14 at 1:27
1

Great write up by Jesse Knowles - took me 10 minutes to be up-and-running with https. http://www.jesseknowles.com/blog/article/forcing-https-on-an-expressionengine-site/

| improve this answer | |
  • Thanks for the link to the article. I implemented those fixes but one of the images published through Low Variables is still using "http". Also, if I use "RewriteCond %{HTTPS} off" I get an error that an infinite loop prevents the site from loading. So I've been using "RewriteCond %{HTTPS} on!" instead, but that doesn't seem to be forcing the https. :( – Todd May 28 '14 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.