Can I secure my Homestead Website with HTTPS?

  • 24
  • 43
  • Question
  • Updated 3 weeks ago
  • Answered
  • (Edited)
For SITEBUILDER PLUS ONLY. Do not use if you have Website Builder.

If you have a Simplestore using Sitebuilder Plus, DO NOT PROCEED WITH THIS PROCEDURE.
For more information please read this topic
:

https://community.homestead.com/homestead/topics/sitebuilder-plus-simplestore-not-working-with-cloud...


Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propagate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.

*click on images to enlarge*

This topic addresses displaying a "secure" rating in the address bar. Currently your site shows an information icon to the left of your URL. If you click it, the message will say the site is not secure.


If you have a contact form this is important. As soon as you begin filling in a field in the form, the browser will display a more obvious message in the address bar.


To secure your site you will need to update your nameservers using Cloudflare. Below are detailed instructions on correctly configuring this so your website will be secure and your customers will feel more confident providing you their contact information.

1) Go to http://www.cloudflare.com and click on the sign up link.


2) Please enter your email address and password you wish to use for your Cloudflare account. If possible, please do not use an email address connected to your domain.
We strongly recommend you read the term and conditions. To continue you must agree to the terms and conditions by checking the box. If you agree, click on create account.


3) Enter your domain name and click on Add site


4) When the scan is complete, click next.

5) Select the FREE plan and click Confirm Plan.


6) Compare the DNS records Cloudflare scanned to your existing DNS records. They should match. If they do, click Continue.


If they don't, you can click on the name or value inside of Cloudflare that is incorrect and edit it. If you need help viewing your current DNS records, please see our topic, How can I view and edit my DNS records using Homestead nameservers.



NOTE: Please make sure to verify that the MX record has been added inside of CloudFlare's DNS settings. If you do not see a record with MX next to it, then we will need to add the MX record.


Click MX in the drop down, then click Name and type @, then Click to configure just right of that box. It will open a new window, please confirm your MX record.
If you are using email with Homestead, for server you will add mx.YOURDOMAIN.com, and for Priority you can put 10. Click save, then click Add Record.


7) Cloudflare will now provide you the new nameservers for your domain. If you do not see your nameservers, proceed to the DNS page inside of Cloudflare, and scroll down until you see Cloudflare Nameservers.

Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propogate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.



8) Log into your Homestead account and click the domains tab on the left. Under the domain you are working on, click Edit your nameservers. You will need to click delete next to ns3.mdnsservice.com and then change the other 2 nameservers to the ones provided by Cloudflare. You can't change and delete in the same step, so you will need to click edit twice.


9) Return to Cloudflare and click Continue.


10) The first part is now completed. Now, please review the Domain Summary and confirm that the SSL shows Flexible. If it does not, click the SSL option, and select Flexible.
(Note: you can also click Crypto at the top, then select Flexible with the drop-down menu on the right. This should save automatically after you select Flexible)


11) Over the next 24 hours, try manually typing in your site with https. If it isn't set up yet, you'll get an error page. Just type https://(www.yourdomain.com)  and when you see your site load with HTTPS, please proceed to the next step.


NOTE: Do not proceed to the next step until you can view your website when using HTTPS (https://www.yourdomain.com) When you see your site load with HTTPS, continue to step #12.

12) Click on the Crypto button at the top.


13) In the top section you should now see the status as Active Certificate. On the right side of that section, make sure it shows flexible. You now need to tell all http requests to forward to https. Scroll to the middle of this long page and look for the section entitled "Always use HTTPS" Turn it on. Also scroll to the bottom and find "Automatic HTTPS Rewrites" Turn it on


In a few minutes your all requests to you site will show secure.
If your site is not showing fully secure, please go republish your site.


Note: This solution is for Sitebuilder Plus sites only.
Photo of Homestead FAQ

Homestead FAQ, Employee

  • 41,196 Points 20k badge 2x thumb

Posted 9 months ago

  • 24
  • 43
Photo of Jill1739

Jill1739

  • 1,848 Points 1k badge 2x thumb
Any idea on how to get "HTTPS" on "homestead hosted by bigcommerce" websites?
Photo of Drew N

Drew N, Community Manager

  • 258,438 Points 100k badge 2x thumb
This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?
Photo of Drew N

Drew N, Community Manager

  • 258,438 Points 100k badge 2x thumb
This question is related to Storefront

Please reference the new conversation here: Can I use SSL on Sotrefront?
Photo of Aki5540

Aki5540

  • 2,082 Points 2k badge 2x thumb
This reply was created from a merged topic originally titled I went in reverse.

I re did my nameservers. Can someone check to see if I'm ok. I appreciate the idea. I should have read more because upon reading I realized it wasn't for me. Thank you for the heads up.
How can I secure my site?
Photo of Marcella7180

Marcella7180

  • 484 Points 250 badge 2x thumb
It still showing that I'm not a part of certificate.  It still show https and not the word secure.
Photo of Drew N

Drew N, Community Manager

  • 259,198 Points 100k badge 2x thumb
It appears that it might be the Flash element. If you look in your crypto tab in Cloudflare, does it show the certificate as Active? If so, try removing the flash element and publishing.
Photo of Drew N

Drew N, Community Manager

  • 259,198 Points 100k badge 2x thumb
Marcella7180, you also have html boxes on the page that link to other sites to display images. Those links are to http sites. You would need to see if you can server those links to https. If not, those will have to be removed from the page as well.
Photo of Steve5559

Steve5559

  • 80 Points 75 badge 2x thumb
test
Photo of Edward5521

Edward5521

  • 342 Points 250 badge 2x thumb
After following the above instructions, my site has "https" but it does not show "secure". Instead the info says "your connection to this site is not fully secure". So how do I make "secure"appear? 
(Edited)
Photo of Gilbert5296

Gilbert5296

  • 102 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled Submit Button returns an "https://" instead of "http://" causing DNS error.

I added a payment form w/ a paypal/credit card html code. The submit button returns a message that my info was submitted. However, the "Back" to payment form button returns a DNS error message. I noticed, that it is re-directing me to an "https://" url address instead of my website's which is an "http://" url address. the URL address are similar except it is "https://" instead of "http://". How can I fix it so my customers will not get annoyed and frustrated?
Photo of Robert8334

Robert8334

  • 200 Points 100 badge 2x thumb
Thank you so much. I have been asking Homestead to add a secure page option for years. Is there any way to specify just one webpage to be secure or must the entire website be secure?
Photo of Drew N

Drew N, Community Manager

  • 258,138 Points 100k badge 2x thumb
The whole thing.
Photo of Pat6389

Pat6389

  • 1,034 Points 1k badge 2x thumb
so I went through the simple instructions and set up HTTPS on 2 websites however now my youtube videos are being blocked, any Idea why?

In other words, my websites are being marked as "secure" but firefox and chrome say they have blocked parts of the page that are "not secure", which for some reason are the youtube videos, but we all know that youtube video's ARE secure and I have double checked that the Video URL's are in fact HTTPS

So have you heard of this before...any idea why that is happening?

it only happens to me when I visit my websites, it does not happen when I visit other websites that have youtube videos on them.

I'd rather not show the websites publicly, so if you need to see them please let me know how I can show them to you privately

Thanks
(Edited)
Photo of Pat6389

Pat6389

  • 1,034 Points 1k badge 2x thumb
yes, I think that feature will solve problems for people who have outgoing links on their site that are formatted with HTTP but actually resolve to HTTPS... chrome and Firefox would otherwise block the outgoing link, but this way they won't...

Cheers and thanks again for your prompt replies
(Edited)
Photo of Drew N

Drew N, Community Manager

  • 258,802 Points 100k badge 2x thumb
We'll see. I'm still getting this fixed on our end, as this solution may not cover every site. A big one like YouTube is easy, but to be safe we can fix this on our end. And of course there is always the possibility that a site does not resolve to https and so won't redirect. But, still an excellent find and an easier way for you to solve your situation than getting the code.
I have an issue with just one of my websites pages being https the others all say not fully secure now what?
should I enable the hsts on cloudflare?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 12,294 Points 10k badge 2x thumb
Hey swankyzmanistee0968

Your site is showing as fully secure on my end!
Do I need to do this for all domains we have or just the main one?  www.MorahanBrothers.com is our main one but we have medfieldlandscapema.com and medfieldlandscape.com point to that page.
Photo of Drew N

Drew N, Community Manager

  • 259,004 Points 100k badge 2x thumb
If the domains redirect to www.MorahanBrothers.com then you should only need to do the main domain. If the domain brings up its own site, then you need to do this for each domain.
Photo of Robert8891

Robert8891

  • 182 Points 100 badge 2x thumb
My change on cloudfare says "active" does that mean it's ready or will i need to wait a day, also i tried to go to my site and it's not being found after I did the change to https -- what's up with that
Photo of Drew N

Drew N, Community Manager

  • 259,004 Points 100k badge 2x thumb
Robert8891, Which site? I can take a look
Photo of Robert8891

Robert8891

  • 182 Points 100 badge 2x thumb
interesting people with bob brill, also the big issue still remains making it fit all monitors and mobile. I saw your step by step but that was five years ago and wiht the old site builder. what is the procedures with the new site builder?
Photo of R.9229

R.9229

  • 1,716 Points 1k badge 2x thumb
Hi! I'm not a moderator, but I just checked your beautiful websites and the only one that didn't work for me was reelmadnessfishing. Otherwise, they all look fine.

You might have to wait until Monday for an official reply.
Photo of Mary7894

Mary7894

  • 1,186 Points 1k badge 2x thumb
Months ago, I moved all my retail off my homestead site to a different venue because even with the Cloudflare trick, I couldn't get https on those pages with drop-in html PayPal buttons. Is this issue resolved yet? Would really like to offer some goods for sale on my site. Thanks.
Photo of Drew N

Drew N, Community Manager

  • 258,852 Points 100k badge 2x thumb
This isn't really an issue. It is the design. HTML is placed within an iframe, which may be why it doesn't show as secured. If you use the built in buttons within the program, or the ecommerce store, you will still see the secure rating in the browser.
This reply was created from a merged topic originally titled HOMESTEAD SSL HTTPS Solution for Homestead Desktop & Homestead Plus.

When will Homestead get the HTTPS and SSL solution? Is it a month away? two weeks away? I mean, all our websites are going to get dinged by GOOGLE because of this? Some of us are using the Homestead Desktop version as well. Please advise
Photo of Drew N

Drew N, Community Manager

  • 259,114 Points 100k badge 2x thumb
DIAMOND VENTURE NETWORK, this solution is valid for Sitebuilder Plus. I do not currently have information on the desktop program
Photo of veronica4546

veronica4546

  • 70 Points
I just payed with godaddy for this ssl certificate.... to find out that its not compatible with homestead hosting...  honestly is it some time soon?
Photo of Drew N

Drew N, Community Manager

  • 258,598 Points 100k badge 2x thumb
veronica4546, There is no need to purchase anything at all to get your site secure. This topic describes how to do it absolutely free. It works on all sites published with Sitebuilder Plus or Websitebuilder.
Photo of Cathy Ginter

Cathy Ginter

  • 672 Points 500 badge 2x thumb
Hey Drew, thanks for the great instructions. It worked perfectly on my site @ https://www.cathyginter.com
Photo of Drew N

Drew N, Community Manager

  • 259,174 Points 100k badge 2x thumb
You're welcome!
Photo of PermaGaia

PermaGaia

  • 816 Points 500 badge 2x thumb
Hi there, I'm wondering if I need to go through these steps? I just tested the contact form on our website and did not get any "more obvious message in the address bar." using Firefox... We have received emails from folks using the form (with no comment about security) but want to ensure everyone feels safe using it (and we haven't lost anyone because they don't).
Photo of Drew N

Drew N, Community Manager

  • 257,878 Points 100k badge 2x thumb
PermaGaia, I would. The warnings are subtle and different browsers warn a little differently. It isn't very difficult and it will ensure that your customers feel safe in filling out your forms. As an added bonus, https gives you a small ranking boost.
Photo of PermaGaia

PermaGaia

  • 816 Points 500 badge 2x thumb
Excellent, thank you. Will get on that now. And thanks for the helpful step-by-step too!
Photo of Drew N

Drew N, Community Manager

  • 257,878 Points 100k badge 2x thumb
You're welcome
Photo of Jim6388

Jim6388

  • 126 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled SSL certificate???.

I got a notice that I needed to get an SSL certificate for my website.  There was an old post regarding this and the process seemed complicated.  Is anything being offered in the regard as Google has made July 1 the deadline for websites to get this certificate or searches will be much worse.
Photo of Drew N

Drew N, Community Manager

  • 257,878 Points 100k badge 2x thumb
July 1st simply marks when Google will show the site as non-secure in Chrome. This is only important if you use a form to collect data. Is it a ranking factor, yes, but currently it is only a tiebreaker, not major. In any case, here are the instructions. It is quite a few steps, but very simple.
Photo of Robert8891

Robert8891

  • 182 Points 100 badge 2x thumb
I go to Cloudflare and open my account for bobbrill.com. It tells me to go to homestead and click on "edit name server name" but this does not appear on my editing platform. My other sites do have that, but not this one for some reason. Yet my site still does not respond to the https while still responding to http.  what does this mean? and how do I fix it.
Photo of Drew N

Drew N, Community Manager

  • 257,878 Points 100k badge 2x thumb
Your domain is registered at GoDaddy, not Homestead. You can only update nameservers at the domain host. Did you review the DNS settings from the Advanced DNS tab with what Cloudflare scanned? You want to make sure those are the same before changing nameservers.
Photo of Judith4708

Judith4708

  • 454 Points 250 badge 2x thumb
This reply was created from a merged topic originally titled Changeover website address to https.

Is there any update to the instructions for converting a website address to https? It appears that there were some workarounds needed. I hesitate to changeover if there are still problems, but time is running out. Please answer.
Photo of Drew N

Drew N, Community Manager

  • 258,128 Points 100k badge 2x thumb
This is not a workaround, nor are there any issues I am aware of. These instructions will secure your site.
Photo of Vincent8294

Vincent8294

  • 102 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled how do I make my web site with you a secure web site.

http://www.reelsportfishingcharters.com
Photo of long8581

long8581

  • 92 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled How do I convert to https.

So how do you convert the website over to HTTPS?

Note: This conversation was created from a reply on: How do I make my site secure.
Photo of veronica4546

veronica4546

  • 70 Points
Hello I followed your instructions regarding securing my account using cloudflare... It's been 48 hours since cloudfare informed my website was active, but my site will not come up. Showing a "website coming soon message".  I log into my cloudflare account and it say my website is active... Please instruct  www.denversconcrete.com
Photo of Drew N

Drew N, Community Manager

  • 258,598 Points 100k badge 2x thumb
veronica4546, In your Cloudflare account, go to the DNS settings and change the IP address for the @ record from  216.40.47.17to 146.148.102.201. If all the other settings are the same as these instructions it should resolve the issue. Otherwise, please go through these steps again and make sure all the settings are correct. Since you changed the nameservers back, I am no able to see the results.
Photo of Hannes0245

Hannes0245

  • 162 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled Kindly please secure my site Afnetimex and your data with HTTPS..

Unable to open mail contact links on my website 
Photo of Todd H

Todd H, Social Media Specialist

  • 20,044 Points 20k badge 2x thumb
The links are something different that I replied to from your other post. At the moment, we recommend using this solution to allow your website to be SSL protected.
Photo of Manuel9083

Manuel9083

  • 200 Points 100 badge 2x thumb
Hi, thank you for the trick and all the comments.

It worked for my site www.ardilalaw.com. My site  is showing on a https. But, chrome says the connection is in status of “Info or Not secured”. It does not say it is a dangerous connection, just not quite secured. 

How to I upgrade to “Secure”?

Thanks is advance

Photo of Todd H

Todd H, Social Media Specialist

  • 19,954 Points 10k badge 2x thumb
I do see the page is loading with the HTTPS, but the error you are seeing is because of the HTML on your website. This is a known issue that we are hoping to see resolved real soon.
Photo of Manuel9083

Manuel9083

  • 200 Points 100 badge 2x thumb
Any updates?
Photo of Drew N

Drew N, Community Manager

  • 258,498 Points 100k badge 2x thumb
I would try removing all the HTML boxes on one page and see if it shows secure then. It should if your Cloudflare is all set up correctly. Then add them back, one at a time. When you find the one(s) causing the problem, see if they have updated code or omit that box from the page if that is not possible.
Photo of Ken4887

Ken4887

  • 60 Points
Using the https connection the facebook like button and comments plug-in (at the bottom of the home page) won't load in. Is there any options in cloud flare to allow those?
https://www.ehlencontracting.com/
Photo of Todd H

Todd H, Social Media Specialist

  • 19,954 Points 10k badge 2x thumb
We have a ticket placed regarding Facebook elements not connecting. I am not entirely sure if it is also related with the recent privacy issues with Facebook and pending updates, but I will include your site info into the ticket as well.
Photo of tammy6738

tammy6738

  • 60 Points
Is there any update on this? Neither of those threads you link to have any info. I've tried the CloudFlare solution but BigCommerce won't let me edit my NS entries. I'm also on the legacy admin of BigCommerce (not sure why or how to upgrade that) and none of their SSL solutions appear to be available to me. 
Photo of Mitchell2929

Mitchell2929

  • 92 Points 75 badge 2x thumb
I have followed the instructions above, including turning on Automatic HTTPS Rewrites on Cloudflare, but I am still getting "mixed content" errors for the images and it looks like javascripts, too. Please see https://www.mjrichlawoffice.com/

It's been over 24 hours since I set up Cloudflare.
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 11,104 Points 10k badge 2x thumb
Hello  david2953

This is an issue that we are seeing with social media elements like Facebook or Twitter, as well as HTML elements like 3rd party forms. We have escalated the issue to our dev team and they are working on fixing this. We are in the process of getting SSL implemented on our end and this is one of the issues we are seeing in the process. We will definitely keep everyone updated with any changes.
Photo of david2953

david2953

  • 6,450 Points 5k badge 2x thumb
Elyzabeth...I reached out to Cloudflare support and provided them with a har file of one of the pages in question.  In the event this may be helpful to you I have the file available to send to Homestead.

The following are the comments from Cloudflare

I wanted to confirm that the requests for the twitter feed/embedded form were being sent via HTTPS.

While investigating this issue, I stumbled upon a nearly identical ticket in which it was determined that the requests were hanging on Homestead's end (specifically, the issue stemmed from the site moving away from Homestead's nameservers).

At this point, I'd recommend talking to a support contact at Homestead. Let me know if you have any additional questions!

Best,
Quincy

Support Engineer | Cloudflare
Photo of Kyle0763

Kyle0763

  • 202 Points 100 badge 2x thumb
any updates on embedding HTML? My sites are seeing far less conversions without being able to embed HTML scheduling. 
Photo of david2953

david2953

  • 6,450 Points 5k badge 2x thumb
They just fixed it.  Its working fine on my site.
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 11,104 Points 10k badge 2x thumb
Yes this issue has been resolved.
Photo of Judith4708

Judith4708

  • 454 Points 250 badge 2x thumb
I follow the Cloudfare instructions up to the "DNS Modifications Instructions." On the Homestead pages, I don't see any addresses that look like this instruction illustration, but only "finalexitnetwork.org (pointed domain)", so where do I put the new information to redirect? It says to remove the named server "ns2.mdnsservice.com" and change "ns3.mdnsservice.com" and "ns1.mdnsservice.com" to ns1.mdnsservice.com and owen.ns.cloudflare.com respectively. Am I being too literal? I don't see these names anywhere. Tell me what to change and do I really change to owen.ns.cloudflare.com? At first it did not recognize Homestead and I put "other"??
Photo of Todd H

Todd H, Social Media Specialist

  • 19,954 Points 10k badge 2x thumb
The reason you are not seeing the option to update nameservers is because your domain is pointing from I.E.C.C., a different hosting provider. Contact these folks, and they should be able to assist with updating the nameservers from our nameservers to Cloudflare's nameservers.
Photo of Schnauzer Lover

Schnauzer Lover

  • 208 Points 100 badge 2x thumb
Is Homestead working at all on a direct resolution for their customers that do not want to sign up for Cloudfare?
Photo of Steve9540

Steve9540

  • 270 Points 250 badge 2x thumb
I wish Homestead would come up with something for this. I tried the Cloudfare thing but I didn't like the way it was going so I stopped the process. It sounds like I am handing my site over to them and even though I chose the free option they wanted payment information. Not comfortable with this process and I am considering shutting down my site after this renewal I just did is up. It is just too much and a lot I don't understand.
Thanks Drew! I followed all the instructions yesterday and now have a secure site! However three pages with some outgoing links have the 'not totally secure' warning... And I did all the suggested 'Auto and all the time' things... Been waiting for Homestead to offer this a long time, so I am very happy, so far. :) https://www.kirkmcguire.com
Photo of bookministry

bookministry

  • 628 Points 500 badge 2x thumb
WOW - I GOT SEVEN OF MY WEBSITES NOW SECURE ... Thanks Homestead !!!! and thanks CloudFlare - you guys are AWESOME.
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 11,104 Points 10k badge 2x thumb
Hey bookministry
I'm so glad!!

Photo of Elyzabeth

Elyzabeth , Official Rep

  • 11,104 Points 10k badge 2x thumb
Kirk McGuire Bronze Sculpture

This means that on those pages that you are seeing it not fully secure, there is some sort of element (HTML or a page hits counter usually) that is not secure. I would go through and see if you can correct any HTML you have to also display as https:// and delete any page hit counters. Then republish your site.