http to htps

[Kitty]

I would also be interested in how this works with NOF.

Me, I found it rather difficult what I have I read about the procedures setting up a secure site. I also found out in the sources I have read (like Thawte), that with static websites (like I produce), where no personal information, passwords etc. are collected, I don't need SSL and https yet and in the near future.

Hi Peter,

I just explained this to a client so I have this lovely screenshot I'll show you. Like Franko said below, it's all about security these days, and your Google ranking can be affected if your site is not secure. In Chrome, next to your url, where you usually see the little green lock to indicate a secure page, it will also say "secure" as well as say "Not secure" if you do not have an SSL.

[gprit]

My understandign about Google and secure sites (SSL) is that "websites displayed using the Google Chrome web browser which contain either a password or credit card form will be marked as 'not secure' ...and be ranked lower.

I don't see anywhere that this applies to 'showcase' sites, which have no logins and no card input forms.

[gprit]

Interestingly I noticed that the forum website is NOT https.......so logins could be compromised.....

[laurasewobsessed]

I'm looking through this post and noticed that her pictures are not showing in https either
https://fullmoongraphics.com/kitty/kitty.html
They still show in http

Where is the .htaccess file?
I assume it can be found in the assets view but I don't see it listed.
Thank you
Laura

[franko]

.htaccess is a server file. It is not found in Netobjects. You need to download it from your server and edit it in a text editor. There are heaps of resources on the web telling you how to do this. Not sure, but I do believe you have to be on a unix/apache server; I'm not experienced at all with microsoft servers so don't know if they have .htaccess or an equivalent.

[laurasewobsessed]

Thank you Franko

[WM325]

you do not change anything in Nof

all you need to do is upload your site as usual and make sure you modify the .htaccess file so it contains as seen at bottom, and nothing else

you also need to make sure that you don't have any links to local content pointing to http otherwise you get a warning that only parts are secure.

example:
<link rel="shortcut icon" href="https://www.videoproductions.com.au/antons.ico" type="image/x-icon"> (correct)
<link rel="shortcut icon" href="http://www.videoproductions.com.au/antons.ico" type="image/x-icon"> (wrong)



RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

When you say "and nothing else" is that true? I also use .htaccess to set 404 pages etc. Must I delete those instructions?

[rick6811]

According to the Apache help file:

"You should avoid using .htaccess files completely if you have access to httpd main server config file. Using .htaccess files slows down your Apache http server. Any directive that you can include in a .htaccess file is better set in a Directory block, as it will have the same effect with better performance."

You should go to your hosting co. and get support on how to configure THEIR servers. Only they know what's in their httpd.conf file. And they can tell you if you have access to it.

You can put anything needed in the config files. The above statement about not putting anything else was just a statement about the https configuration. Of coarse you can put other stuff in the file that is appropriate.

For MS IIS servers there is the web.config file to use in place of htaccess.

I know a couple of hosting cos. that use scripts to take anything put into an htaccess file, reload the httpd file with it's contents, then kill the htaccess file. The user didn't even know his htaccess file disappeared. The user sees one but it's not really there being read anymore until it's changed or added to by the user. What was changed is scanned by security software before it's reloaded into httpd.conf. Your hosting co. doesn't trust you any more than they would Russian hackers opening accounts to inject malware into their data center.

[antonsvideo]

When you say "and nothing else" is that true? I also use .htaccess to set 404 pages etc. Must I delete those instructions?

you can add anything to the .htaccess, what I meant is that the 3 lines is all that is needed for permanent https redirection

my .htaccess also has other entries to redirect old page names that no longer exist to their new pages

[John Medhurst]

I am having problems with https as well (having paid my ISP for a secure certificate !)..
Where do I find the .htaccess file ? Or do I have to create one ?