u5CMS with SSL TLS (force HTTPS)
Today it is a MUST to transport web content only with encryption. Website transportation is encrypted, when its protocol is https:// (http:// without s is not encrypted).HTTPS, why?
- HTTPS protects the integrity of your website
- HTTPS protects the privacy and security of your users
- HTTPS is the future of the web
- HTTPS leads to a better Google ranking
HTTPS, how?
SSL-Certificate and Settings in u5CMS
- Install an SSL-Certificate. For that, log in to the Hosting Control Panel offered by your provider. With only a few clicks you should be able to install a free Let's Encrypt Certificate. Providers not offering free Let's Encrypt Certificates are behind the times (change provider).
- In your u5CMS's file config.php, set the following values:
$scripturi='https://'.$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];
$forcehttpsonfrontend='yes';
$forcehttpsonbackend='yes';
$forcehttpsonfrontend='yes';
$forcehttpsonbackend='yes';
Extra security by rewriting HTTP to HTTPS
The above settings in config.php automatically enforce the use of HTTPS on your u5CMS pages. However, they do not enforce HTTPS if an image etc. is directly requested by its direct URL. To rewrite every request to HTTPS, create a file named .htaccess with the following content and put it in the surfable main directory of your webserver (this directory has a name like httpdocs, htdocs, www; in case of doubt, ask your provider. If there is already a .htaccess file, add the lines at its beginning):RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
Hint: Do not use http-non-s sources on HTTPS pages
×
Problem
If your page is https://something you can no longer use sources which are not HTTPS.
HTML examples:
✘<img src="http://urltoanimage...
✘<iframe src="http://urltosomething...
CSS example:
✘@import url(http://urltosomething...
Solution
You have also to use https:// :
HTML examples:
✔<img src="https://urltoanimage...
✔<iframe src="https://urltosomething...
CSS example:
✔@import url(https://urltosomething...
×
You may also use protocol-relative URLs (just starting with 2 slashes). Be aware that https-only resources are not available if a protocol-relative URL on an http-non-s page is pointing to them.
