Skip to main content
Brand User

647 Messages

 • 

44K Points

Mon, Feb 26, 2018 10:46 PM

Can I Secure My Homestead Website With HTTPS?

For SITEBUILDER PLUS ONLY. Do not use if you have Website Builder.

If you have a Simplestore using Sitebuilder Plus, DO NOT PROCEED WITH THIS PROCEDURE.
For more information please read this topic
:

https://community.homestead.com/homestead/topics/cloudflare-common-cloudflare-issues


Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propagate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.

*click on images to enlarge*

This topic addresses displaying a "secure" rating in the address bar. Currently your site shows an information icon to the left of your URL. If you click it, the message will say the site is not secure.


If you have a contact form this is important. As soon as you begin filling in a field in the form, the browser will display a more obvious message in the address bar.


To secure your site you will need to update your nameservers using Cloudflare. Below are detailed instructions on correctly configuring this so your website will be secure and your customers will feel more confident providing you their contact information.

1) Go to http://www.cloudflare.com and click on the sign up link.


2) Please enter your email address and password you wish to use for your Cloudflare account. If possible, please do not use an email address connected to your domain.
We strongly recommend you read the term and conditions. To continue you must agree to the terms and conditions by clicking on create account.


3) Enter your domain name and click on Add site

4) Select the FREE plan and click Confirm Plan.



5) Cloud flare will scan your current DNS settings and automatically populate the found DNS records. When the scan is complete, and you see all records present, click continue .




6) Compare the DNS records Cloudflare scanned to your existing DNS records. These can be found in your Homestead account, under Domains > Advanced DNS settings. They should match. If they do, click Continue.


If they don't, you can click on the name or value inside of Cloudflare that is incorrect and edit it. If you need help viewing your current DNS records, please see our topic, How can I view and edit my DNS records using Homestead nameservers.



NOTE: Please make sure to verify that the MX record has been added inside of CloudFlare's DNS settings. If you do not see a record with MX next to it, then we will need to add the MX record.


Click MX in the drop down, then click Name and type @, then Click to configure just right of that box. It will open a new window, please confirm your MX record.
If you are using email with Homestead, for server you will add mx.YOURDOMAIN.com, and for Priority you can put 10. Click save, then click Add Record.


7) Cloudflare will now provide you the new nameservers for your domain. If you do not see your nameservers, proceed to the DNS page inside of Cloudflare, and scroll down until you see Cloudflare Nameservers.

Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propagate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.



8) Log into your Homestead account and click the domains tab on the left. Under the domain you are working on, click Edit your nameservers. You will need to click delete next to ns3.mdnsservice.com and then change the other 2 nameservers to the ones provided by Cloudflare. You can't change and delete in the same step, so you will need to click edit twice. Click Submit


9) Return to Cloudflare and click done check nameservers.



10) The first part is now completed. Now, please review and confirm that the SSL is set to Flexible and always use HTTPS is turned on. 



11) Over the next 24 hours, try manually typing in your site with https. If it isn't set up yet, you'll get an error page. Just type https://www.yourdomain.com  and when you see your site load with HTTPS, please proceed to the next step.


NOTE: Do not proceed to the next step until you can view your website when using HTTPS (https://www.yourdomain.com) When you see your site load with HTTPS, continue to step #12.

12) Click on the SSL/TLS button at the top and select Edge Certificates. 



13) Scroll down on this page and look for the section entitled "Always use HTTPS" Turn it on. Also scroll to the bottom and find "Automatic HTTPS Rewrites" Turn it on. All other settings you can leave as default.




In a few minutes, your site will show secure.


If your site is not showing fully secure, please go republish your site.


Note: This solution is for Sitebuilder Plus sites only.

Responses

29 Messages

 • 

1.9K Points

3 years ago

Any idea on how to get "HTTPS" on "homestead hosted by bigcommerce" websites?

1.4K Messages

 • 

262.9K Points

This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?

1.4K Messages

 • 

262.9K Points

This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?

4 Messages

 • 

222 Points

i have my domain pointed to an ecwid store so where am i supposed to do the SSL ?  I have tried with HS following the instructions but its not working - my sites are all down !

57 Messages

 • 

2.4K Points

3 years ago

This reply was created from a merged topic originally titled I went in reverse.

I re did my nameservers. Can someone check to see if I'm ok. I appreciate the idea. I should have read more because upon reading I realized it wasn't for me. Thank you for the heads up.
How can I secure my site?

24 Messages

 • 

646 Points

3 years ago

It still showing that I'm not a part of certificate.  It still show https and not the word secure.

1.4K Messages

 • 

262.9K Points

It appears that it might be the Flash element. If you look in your crypto tab in Cloudflare, does it show the certificate as Active? If so, try removing the flash element and publishing.

1.4K Messages

 • 

262.9K Points

Marcella7180, you also have html boxes on the page that link to other sites to display images. Those links are to http sites. You would need to see if you can server those links to https. If not, those will have to be removed from the page as well.

2 Messages

 • 

130 Points

test

9 Messages

 • 

432 Points

After following the above instructions, my site has "https" but it does not show "secure". Instead the info says "your connection to this site is not fully secure". So how do I make "secure"appear? 

3 Messages

 • 

152 Points

3 years ago

This reply was created from a merged topic originally titled Submit Button returns an "https://" instead of "http://" causing DNS error.

I added a payment form w/ a paypal/credit card html code. The submit button returns a message that my info was submitted. However, the "Back" to payment form button returns a DNS error message. I noticed, that it is re-directing me to an "https://" url address instead of my website's which is an "http://" url address. the URL address are similar except it is "https://" instead of "http://". How can I fix it so my customers will not get annoyed and frustrated?

4 Messages

 • 

250 Points

3 years ago

Thank you so much. I have been asking Homestead to add a secure page option for years. Is there any way to specify just one webpage to be secure or must the entire website be secure?

1.4K Messages

 • 

262.9K Points

The whole thing.

22 Messages

 • 

1.2K Points

3 years ago

so I went through the simple instructions and set up HTTPS on 2 websites however now my youtube videos are being blocked, any Idea why?

In other words, my websites are being marked as "secure" but firefox and chrome say they have blocked parts of the page that are "not secure", which for some reason are the youtube videos, but we all know that youtube video's ARE secure and I have double checked that the Video URL's are in fact HTTPS

So have you heard of this before...any idea why that is happening?

it only happens to me when I visit my websites, it does not happen when I visit other websites that have youtube videos on them.

I'd rather not show the websites publicly, so if you need to see them please let me know how I can show them to you privately

Thanks

1.4K Messages

 • 

262.9K Points

Hi Pat, I see the YouTube video on the Websitebuilder site. You do need to be careful with external links. They may have a problem if you don't link to https. Can you tell me which page it is on? I can probably find the correct site from the page name.

22 Messages

 • 

1.2K Points

I changed 2 websites and it happening on both but for now lets just focus on one of them as I'm sure the answer will be the same

If you are able to see my websites from your backend I'm talking about the one that starts with 506sed...

1.4K Messages

 • 

262.9K Points

I see the problem Pat. The code is passing the URL as http, even though you have it set to https. We'll have to have the developers fix that. In the short term, you can get the embed code from your Youtube account and delete that element. Then add an HTML box and enter the code there. This will eliminate the unsecure content barrier.

If you need help with that, let me know. Sorry for the inconvenience.

22 Messages

 • 

1.2K Points

perfect work-around Drew... Thanks very much

But it would be nice if the developers could fix the issue ASAP as I have many websites that I will be setting up the HTTPS on, and it would be a pain in the butt to have to change all my youtube videos

One other question if you don't mind...

...when you google my website address and click on it in the search results, it opens as HTTP ... is there a specific reason why it is not directing to HTTPS?

1.4K Messages

 • 

262.9K Points

Yes, Step 12 and 13 above. It will go where told. Those steps will redirect http requests to https.

I agree. We have been updating Sitebuilder Plus to allow for https, but we must have missed the Youtube. A request to fix has been entered.

8 Messages

 • 

366 Points

3 years ago

Do I need to do this for all domains we have or just the main one?  www.MorahanBrothers.com is our main one but we have medfieldlandscapema.com and medfieldlandscape.com point to that page.

1.4K Messages

 • 

262.9K Points

If the domains redirect to www.MorahanBrothers.com then you should only need to do the main domain. If the domain brings up its own site, then you need to do this for each domain.

8 Messages

 • 

252 Points

3 years ago

My change on cloudfare says "active" does that mean it's ready or will i need to wait a day, also i tried to go to my site and it's not being found after I did the change to https -- what's up with that

1.4K Messages

 • 

262.9K Points

Robert8891, Which site? I can take a look

8 Messages

 • 

252 Points

interesting people with bob brill, also the big issue still remains making it fit all monitors and mobile. I saw your step by step but that was five years ago and wiht the old site builder. what is the procedures with the new site builder?

47 Messages

 • 

2.9K Points

Hi! I'm not a moderator, but I just checked your beautiful websites and the only one that didn't work for me was reelmadnessfishing. Otherwise, they all look fine.

You might have to wait until Monday for an official reply.

10 Messages

 • 

1.2K Points

3 years ago

Months ago, I moved all my retail off my homestead site to a different venue because even with the Cloudflare trick, I couldn't get https on those pages with drop-in html PayPal buttons. Is this issue resolved yet? Would really like to offer some goods for sale on my site. Thanks.

1.4K Messages

 • 

262.9K Points

This isn't really an issue. It is the design. HTML is placed within an iframe, which may be why it doesn't show as secured. If you use the built in buttons within the program, or the ecommerce store, you will still see the secure rating in the browser.

4 Messages

 • 

192 Points

3 years ago

This reply was created from a merged topic originally titled HOMESTEAD SSL HTTPS Solution for Homestead Desktop & Homestead Plus.

When will Homestead get the HTTPS and SSL solution? Is it a month away? two weeks away? I mean, all our websites are going to get dinged by GOOGLE because of this? Some of us are using the Homestead Desktop version as well. Please advise

1.4K Messages

 • 

262.9K Points

DIAMOND VENTURE NETWORK, this solution is valid for Sitebuilder Plus. I do not currently have information on the desktop program

2 Messages

 • 

120 Points

2 years ago

I just payed with godaddy for this ssl certificate.... to find out that its not compatible with homestead hosting...  honestly is it some time soon?

1.4K Messages

 • 

262.9K Points

veronica4546, There is no need to purchase anything at all to get your site secure. This topic describes how to do it absolutely free. It works on all sites published with Sitebuilder Plus or Websitebuilder.

16 Messages

 • 

982 Points

2 years ago

Hey Drew, thanks for the great instructions. It worked perfectly on my site @ https://www.cathyginter.com

1.4K Messages

 • 

262.9K Points

You're welcome!

12 Messages

 • 

866 Points

2 years ago

Hi there, I'm wondering if I need to go through these steps? I just tested the contact form on our website and did not get any "more obvious message in the address bar." using Firefox... We have received emails from folks using the form (with no comment about security) but want to ensure everyone feels safe using it (and we haven't lost anyone because they don't).

1.4K Messages

 • 

262.9K Points

PermaGaia, I would. The warnings are subtle and different browsers warn a little differently. It isn't very difficult and it will ensure that your customers feel safe in filling out your forms. As an added bonus, https gives you a small ranking boost.

12 Messages

 • 

866 Points

Excellent, thank you. Will get on that now. And thanks for the helpful step-by-step too!

1.4K Messages

 • 

262.9K Points

You're welcome

4 Messages

 • 

176 Points

2 years ago

This reply was created from a merged topic originally titled SSL certificate???.

I got a notice that I needed to get an SSL certificate for my website.  There was an old post regarding this and the process seemed complicated.  Is anything being offered in the regard as Google has made July 1 the deadline for websites to get this certificate or searches will be much worse.

1.4K Messages

 • 

262.9K Points

July 1st simply marks when Google will show the site as non-secure in Chrome. This is only important if you use a form to collect data. Is it a ranking factor, yes, but currently it is only a tiebreaker, not major. In any case, here are the instructions. It is quite a few steps, but very simple.

8 Messages

 • 

252 Points

I go to Cloudflare and open my account for bobbrill.com. It tells me to go to homestead and click on "edit name server name" but this does not appear on my editing platform. My other sites do have that, but not this one for some reason. Yet my site still does not respond to the https while still responding to http.  what does this mean? and how do I fix it.

1.4K Messages

 • 

262.9K Points

Your domain is registered at GoDaddy, not Homestead. You can only update nameservers at the domain host. Did you review the DNS settings from the Advanced DNS tab with what Cloudflare scanned? You want to make sure those are the same before changing nameservers.

10 Messages

 • 

534 Points

2 years ago

This reply was created from a merged topic originally titled Changeover website address to https.

Is there any update to the instructions for converting a website address to https? It appears that there were some workarounds needed. I hesitate to changeover if there are still problems, but time is running out. Please answer.

1.4K Messages

 • 

262.9K Points

This is not a workaround, nor are there any issues I am aware of. These instructions will secure your site.