Website not secured?

[TGM]

I made a change so now https:// is the default.
Thanks,
Scott

While you did that, until all your internal links go to https sources, the browser will always call the site insecure, regardless of the SSL cert. Any image that is loaded via http will also cause the site to go insecure.

For example, I just looked at your source. Things like this will kill the lock:

<LINK REL="SHORTCUT ICON" HREF="http://www.besslerwheel.com/favicon.ico">

All references should be https.

Additionally, you can also add code in the htaccess file in your webserver directory to detect and force https for those requests coming in on http.

[agor95]

Thank you Scott for your work on this tricky subject.

The act of redirecting web requests to https:// and re-writing links to the sames is an issue others have suffered.

There are other after this one unfortunately.

regards.

[scott]

While you did that, until all your internal links go to https sources, the browser will always call the site insecure, regardless of the SSL cert. Any image that is loaded via http will also cause the site to go insecure.

For example, I just looked at your source. Things like this will kill the lock:

<LINK REL="SHORTCUT ICON" HREF="http://www.besslerwheel.com/favicon.ico">

While you are correct, when I click around on the site, the https:// stays active, and I think it only really matters on the login page anyway, so I am probably going to leave it as it.

Thanks,
Scott

[TGM]

While you did that, until all your internal links go to https sources, the browser will always call the site insecure, regardless of the SSL cert. Any image that is loaded via http will also cause the site to go insecure.

For example, I just looked at your source. Things like this will kill the lock:

<LINK REL="SHORTCUT ICON" HREF="http://www.besslerwheel.com/favicon.ico">

While you are correct, when I click around on the site, the https:// stays active, and I think it only really matters on the login page anyway, so I am probably going to leave it as it.

Thanks,
Scott

Suit yourself. Eventually, browsers like Chrome will simply turn off access to those sites not fully https compliant. Just a heads up.

[scott]

Eventually, browsers like Chrome will simply turn off access to those sites not fully https compliant. Just a heads up.

That is not true. No browser will ever block non-SSL sites. They will just show a warning. And the login page is now SSL enabled by default. That is the only page that matters on this website.