Can I secure my Homestead Website with HTTPS?

  • 0
  • 6
  • Question
  • Updated 2 days ago
  • Answered
  • (Edited)
This topic addresses displaying a "secure" rating in the address bar. Currently your site shows an information icon to the left of your URL. If you click it, the message will say the site is not secure.


If you have a contact form this is important. As soon as you begin filling in a field in the form, the browser will display a more obvious message in the address bar.


To secure your site you will need to update your nameservers using Cloudflare. Below are detailed instructions on correctly configuring this so your website will be secure and your customers will feel more confident providing you their contact information.

1) Go to http://www.cloudflare.com and click on the sign up link.


2) Please enter your email address and password you wish to use for your Cloudflare account. We strongly recommend you read the term and conditions. To continue you must agree to the terms and conditions by checking the box. If you agree, click on create account.


3) Enter your domain name and click on Add site


4) When the scan is complete, click next.

5) Select the FREE plan and click Confirm Plan.


6) Compare the DNS records Cloudflare scanned to your existing DNS records. They should match. If they do, click continue. If they don't, you can click on the name or value that is incorrect and edit it. If you need help viewing your current DNS records, please see our topic, How can I view and edit my DNS records using Homestead nameservers.


7) Cloudflare will now provide you the new nameservers for your domain.


8) Log into your Homestead account and click the domains tab on the left. Under the domain you are working on, click Edit your nameservers. You will need to click delete next to ns3.mdnsservice.com and then change the other 2 nameservers to the ones provided by Cloudflare. You can't change and delete in the same step, so you will need to click edit twice.


9) Return to Cloudflare and click Continue.


10) You are now set up. It can take up to 24 hours for propagation time. Please confirm that the SSL shows Flexible. If it does not, click Flexible and change it to that option.


11) Over the next 24 hours. periodically try browsing to https://www.yourdomain. When you see your site, please proceed to the next step.

12) Click on the Crypto button at the top.


In the top section you should now see the status as Active Certificate. On the right side of that section, make sure it shows flexible. You now need to tell all http requests to forward to https. Scroll to the middle of this long page and look for the section entitled "Always use HTTPS" Turn it on.


In a few minutes your all requests to you site will show secure.


Note: This solution is for Websitebuilder and Sitebuilder Plus sites only.
Photo of Homestead FAQ

Homestead FAQ, Employee

  • 37,546 Points 20k badge 2x thumb

Posted 2 months ago

  • 0
  • 6
Photo of Jill1739

Jill1739

  • 1,818 Points 1k badge 2x thumb
Any idea on how to get "HTTPS" on "homestead hosted by bigcommerce" websites?
Photo of Drew N

Drew N, Community Manager

  • 244,098 Points 100k badge 2x thumb
This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?
Photo of Drew N

Drew N, Community Manager

  • 244,098 Points 100k badge 2x thumb
This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?
Photo of Aki5540

Aki5540

  • 936 Points 500 badge 2x thumb
This reply was created from a merged topic originally titled I went in reverse.

I re did my nameservers. Can someone check to see if I'm ok. I appreciate the idea. I should have read more because upon reading I realized it wasn't for me. Thank you for the heads up.
How can I secure my site?
Photo of Marcella7180

Marcella7180

  • 362 Points 250 badge 2x thumb
It still showing that I'm not a part of certificate.  It still show https and not the word secure.
Photo of Drew N

Drew N, Community Manager

  • 246,746 Points 100k badge 2x thumb
It appears that it might be the Flash element. If you look in your crypto tab in Cloudflare, does it show the certificate as Active? If so, try removing the flash element and publishing.
Photo of Drew N

Drew N, Community Manager

  • 246,746 Points 100k badge 2x thumb
Marcella7180, you also have html boxes on the page that link to other sites to display images. Those links are to http sites. You would need to see if you can server those links to https. If not, those will have to be removed from the page as well.
Photo of Gilbert5296

Gilbert5296

  • 102 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled Submit Button returns an "https://" instead of "http://" causing DNS error.

I added a payment form w/ a paypal/credit card html code. The submit button returns a message that my info was submitted. However, the "Back" to payment form button returns a DNS error message. I noticed, that it is re-directing me to an "https://" url address instead of my website's which is an "http://" url address. the URL address are similar except it is "https://" instead of "http://". How can I fix it so my customers will not get annoyed and frustrated?
Photo of Robert8334

Robert8334

  • 100 Points 100 badge 2x thumb
Thank you so much. I have been asking Homestead to add a secure page option for years. Is there any way to specify just one webpage to be secure or must the entire website be secure?
Photo of Drew N

Drew N, Community Manager

  • 243,240 Points 100k badge 2x thumb
The whole thing.
Photo of Pat6389

Pat6389

  • 914 Points 500 badge 2x thumb
so I went through the simple instructions and set up HTTPS on 2 websites however now my youtube videos are being blocked, any Idea why?

In other words, my websites are being marked as "secure" but firefox and chrome say they have blocked parts of the page that are "not secure", which for some reason are the youtube videos, but we all know that youtube video's ARE secure and I have double checked that the Video URL's are in fact HTTPS

So have you heard of this before...any idea why that is happening?

it only happens to me when I visit my websites, it does not happen when I visit other websites that have youtube videos on them.

I'd rather not show the websites publicly, so if you need to see them please let me know how I can show them to you privately

Thanks
(Edited)
Photo of Drew N

Drew N, Community Manager

  • 247,834 Points 100k badge 2x thumb
Yes, Step 12 and 13 above. It will go where told. Those steps will redirect http requests to https.

I agree. We have been updating Sitebuilder Plus to allow for https, but we must have missed the Youtube. A request to fix has been entered.
Photo of Pat6389

Pat6389

  • 914 Points 500 badge 2x thumb
thanks again Drew, I missed that somehow... I have made the change and it now working properly :)

Also FYI... in step 12 and 13 there is section called "Automatic HTTPS Rewrites"... turn that ON and it takes care of the problem with youtube videos, because it fixes mixed content by changing “http” to “https” for all resources or links on your web site that can be served with HTTPS.
Photo of Drew N

Drew N, Community Manager

  • 247,834 Points 100k badge 2x thumb
Well cool. I hadn't found that yet. Thank you. I will try to get the topic updated ASAP.
Photo of Pat6389

Pat6389

  • 914 Points 500 badge 2x thumb
yes, I think that feature will solve problems for people who have outgoing links on their site that are formatted with HTTP but actually resolve to HTTPS... chrome and Firefox would otherwise block the outgoing link, but this way they won't...

Cheers and thanks again for your prompt replies
(Edited)
Photo of Drew N

Drew N, Community Manager

  • 247,834 Points 100k badge 2x thumb
We'll see. I'm still getting this fixed on our end, as this solution may not cover every site. A big one like YouTube is easy, but to be safe we can fix this on our end. And of course there is always the possibility that a site does not resolve to https and so won't redirect. But, still an excellent find and an easier way for you to solve your situation than getting the code.
Do I need to do this for all domains we have or just the main one?  www.MorahanBrothers.com is our main one but we have medfieldlandscapema.com and medfieldlandscape.com point to that page.
Photo of Drew N

Drew N, Community Manager

  • 246,592 Points 100k badge 2x thumb
If the domains redirect to www.MorahanBrothers.com then you should only need to do the main domain. If the domain brings up its own site, then you need to do this for each domain.
Photo of Robert8891

Robert8891

  • 172 Points 100 badge 2x thumb
My change on cloudfare says "active" does that mean it's ready or will i need to wait a day, also i tried to go to my site and it's not being found after I did the change to https -- what's up with that
Photo of Drew N

Drew N, Community Manager

  • 245,380 Points 100k badge 2x thumb
Robert8891, Which site? I can take a look
Photo of Robert8891

Robert8891

  • 172 Points 100 badge 2x thumb
interesting people with bob brill, also the big issue still remains making it fit all monitors and mobile. I saw your step by step but that was five years ago and wiht the old site builder. what is the procedures with the new site builder?
Photo of Mary7894

Mary7894

  • 1,186 Points 1k badge 2x thumb
Months ago, I moved all my retail off my homestead site to a different venue because even with the Cloudflare trick, I couldn't get https on those pages with drop-in html PayPal buttons. Is this issue resolved yet? Would really like to offer some goods for sale on my site. Thanks.
Photo of Drew N

Drew N, Community Manager

  • 247,822 Points 100k badge 2x thumb
This isn't really an issue. It is the design. HTML is placed within an iframe, which may be why it doesn't show as secured. If you use the built in buttons within the program, or the ecommerce store, you will still see the secure rating in the browser.
This reply was created from a merged topic originally titled HOMESTEAD SSL HTTPS Solution for Homestead Desktop & Homestead Plus.

When will Homestead get the HTTPS and SSL solution? Is it a month away? two weeks away? I mean, all our websites are going to get dinged by GOOGLE because of this? Some of us are using the Homestead Desktop version as well. Please advise
Photo of Drew N

Drew N, Community Manager

  • 247,954 Points 100k badge 2x thumb
DIAMOND VENTURE NETWORK, this solution is valid for Sitebuilder Plus. I do not currently have information on the desktop program