2

I finally set up my first EE site with SSL. Everything seems to be working ok, but I discovered that some of the pages are "delivering unencrypted elements". What I've found so far:

  • Images added through WYSIWYG are being called via http and not https
  • I am using EE_Twitter, and any images through there are also being delivered via http and not https

If I have a page without either of those, then I get a thumbs-up from the browser.

I am utilizing a master config file, and my .htaccess file looks like this:

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ http://%1/$1 [L,R=301]

RewriteCond %{HTTPS} on!
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php/$1 [L]

Any suggestions would be greatly appreciated!

Improve this question
4
  • 1
    Silly question, but in Admin > General Configuration do you have https addresses in the three URL fields, ensuring that any path variables wind up with https addresses as well? And are you using the native rich text editor?
    – Jean St-Amand
    May 20, 2014 at 10:44
  • I have it in two (URL too root directory and URL to themes folder). I typically leave the site's index page blank. Bad? And no, I'm not using the native rich text editor. Using WYGWAM.
    – Todd
    May 20, 2014 at 19:12
  • Did you happen to develop testing with http links and then switch to https at any point? Wondering whether Wygwam stored http links previously. Another note: you can probably get away with using Low Replace to root out lingering http links even though there's almost certainly a cleaner way.
    – Matt Stein
    May 20, 2014 at 22:21
  • Yes, we worked on it for a while as a "dev." site prior to making the switch. Great idea - I'll look through and see if there are any http links. Any thoughts on how to fix the Twitter part?
    – Todd
    May 21, 2014 at 1:27

1 Answer 1

Reset to default
1

Great write up by Jesse Knowles - took me 10 minutes to be up-and-running with https. http://www.jesseknowles.com/blog/article/forcing-https-on-an-expressionengine-site/

Improve this answer
1
  • Thanks for the link to the article. I implemented those fixes but one of the images published through Low Variables is still using "http". Also, if I use "RewriteCond %{HTTPS} off" I get an error that an infinite loop prevents the site from loading. So I've been using "RewriteCond %{HTTPS} on!" instead, but that doesn't seem to be forcing the https. :(
    – Todd
    May 28, 2014 at 19:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.