Can I secure my Homestead Website with HTTPS?

  • 28
  • 55
  • Article
  • Updated 3 months ago
  • (Edited)
For SITEBUILDER PLUS ONLY. Do not use if you have Website Builder.

If you have a Simplestore using Sitebuilder Plus, DO NOT PROCEED WITH THIS PROCEDURE.
For more information please read this topic
:

https://community.homestead.com/homestead/topics/sitebuilder-plus-simplestore-not-working-with-cloud...


Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propagate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.

*click on images to enlarge*

This topic addresses displaying a "secure" rating in the address bar. Currently your site shows an information icon to the left of your URL. If you click it, the message will say the site is not secure.


If you have a contact form this is important. As soon as you begin filling in a field in the form, the browser will display a more obvious message in the address bar.


To secure your site you will need to update your nameservers using Cloudflare. Below are detailed instructions on correctly configuring this so your website will be secure and your customers will feel more confident providing you their contact information.

1) Go to http://www.cloudflare.com and click on the sign up link.


2) Please enter your email address and password you wish to use for your Cloudflare account. If possible, please do not use an email address connected to your domain.
We strongly recommend you read the term and conditions. To continue you must agree to the terms and conditions by checking the box. If you agree, click on create account.


3) Enter your domain name and click on Add site


4) When the scan is complete, click next.

5) Select the FREE plan and click Confirm Plan.


6) Compare the DNS records Cloudflare scanned to your existing DNS records. These can be found in your Homestead account, under Domains > Advanced DNS settings. They should match. If they do, click Continue.


If they don't, you can click on the name or value inside of Cloudflare that is incorrect and edit it. If you need help viewing your current DNS records, please see our topic, How can I view and edit my DNS records using Homestead nameservers.



NOTE: Please make sure to verify that the MX record has been added inside of CloudFlare's DNS settings. If you do not see a record with MX next to it, then we will need to add the MX record.


Click MX in the drop down, then click Name and type @, then Click to configure just right of that box. It will open a new window, please confirm your MX record.
If you are using email with Homestead, for server you will add mx.YOURDOMAIN.com, and for Priority you can put 10. Click save, then click Add Record.


7) Cloudflare will now provide you the new nameservers for your domain. If you do not see your nameservers, proceed to the DNS page inside of Cloudflare, and scroll down until you see Cloudflare Nameservers.

Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propogate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.



8) Log into your Homestead account and click the domains tab on the left. Under the domain you are working on, click Edit your nameservers. You will need to click delete next to ns3.mdnsservice.com and then change the other 2 nameservers to the ones provided by Cloudflare. You can't change and delete in the same step, so you will need to click edit twice. Click Submit


9) Return to Cloudflare and click Continue.


10) The first part is now completed. Now, please review the Domain Summary and confirm that the SSL shows Flexible. If it does not, click the SSL option, and select Flexible.
(Note: you can also click SSL/TLS at the top, then select Flexible with the drop-down menu on the right. This should save automatically after you select Flexible)


11) Over the next 24 hours, try manually typing in your site with https. If it isn't set up yet, you'll get an error page. Just type https://www.yourdomain.com  and when you see your site load with HTTPS, please proceed to the next step.


NOTE: Do not proceed to the next step until you can view your website when using HTTPS (https://www.yourdomain.com) When you see your site load with HTTPS, continue to step #12.

12) Click on the SSL/TLS button at the top.


13) In the top section you should now see the status as Active Certificate. On the right side of that section, make sure it shows flexible. You now need to tell all http requests to forward to https. Scroll to the middle of this long page and look for the section entitled "Always use HTTPS" Turn it on. Also scroll to the bottom and find "Automatic HTTPS Rewrites" Turn it on


In a few minutes, your site will show secure.


If your site is not showing fully secure, please go republish your site.


Note: This solution is for Sitebuilder Plus sites only.
Photo of Homestead FAQ

Homestead FAQ, Employee

  • 42,636 Points 20k badge 2x thumb

Posted 2 years ago

  • 28
  • 55
Photo of roger8357

roger8357

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled How do I make my website show secure?.

My website shows not secure. Can you make it secure? http://www.shakesandpizza.com
Thank you.
Photo of BRENDAN5166

BRENDAN5166

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled We need help securing out website - it currently says it is not secure..
Photo of Todd H

Todd H, Social Media Specialist

  • 20,824 Points 20k badge 2x thumb
For Sitebuilder sites to be secure, please follow these step by step instructions.
Photo of chris0594

chris0594

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled how do I change my site to https.

convert my current site to https ?
Photo of martin7164

martin7164

  • 284 Points 250 badge 2x thumb
This reply was created from a merged topic originally titled my websites are not secure, can you fix this?.

websites aren't secure please fix this. 
Photo of Allan

Allan

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled Hi, I added a new page to my website with a few links to PDF's. Turns out this p....
Photo of Project6698

Project6698

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled Hi, my site is showing up as 'not secure'. How do I get this resolved?.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled HOW DO I GET HTTPS.

HTTPS
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
To secure your site, you'll need to follow the instructions in this article
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
I am still using the desktop sitebuilder software
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
I see. Since you are using the desktop builder, you wouldn't be able to secure your site. I highly recommend you switch to Sitebuilder Plus at least, in order to secure your site
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
What are the steps required to do that
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
From Sitebuilder Plus, go into your File Manager, select all files, and click Upload. Then, log into your account at homestead.com, click Websites Manager, and choose Edit with Sitebuilder Plus
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Once I have done that then do I perform the procedure you mentioned above?

I will not have to go back and do anything further to the individual pages, right?

I will not be able to use the desktop editor any further, correct?

Is there any negative aspect going to the web based editor from the desktop version? It seems like I discussed this with tech support a while back and there was a real issue in changing, i.e. I would have to do something to each and every page?? 
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
Yes, once you've done that, follow the steps above for the HTTPS capability.
You should not have to do anything to every page, except republish the pages.
You should not revert back to the desktop editor after this has been done, as it can cause errors with your page and cause issue with the SSL

I cannot think of a negative aspect, aside from the fact that it is a little different than the editor you are used to using, so you may experience a learning curve.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Does the web editor have the capability to republish all pages? I have only seen a button to republish the current page.
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
Yes, if you click Publish from Sitebuilder Plus, it will ask if you want to publish all pages or current page. You can also do this from the File Manager. Click on your site name in the top right corner of the builder, click View File Manager, select all pages and click Publish.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
If I have any subfolders in File Manager do I need to also include them in the file selection to Upload?

Are there any known bugs in this conversion, i.e. are there things that are not going to convert correctly or may be screwed up? I have a LOT of pages on 2 websites...waaaay too many to think about having to correct on an individual basis if there is an issue
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
There are not any known bugs, but you are using really old technology. I cannot guarantee that all elements will translate 100% correct. Most or all of it should, though.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Wow...that's certainly not very reasuring, again, given the number of pages I have between my two primary sites. "Most" sounds like this could very easily turn into a disaster. I'm assuming you have had issues before since you cannot guarantee the accurate translation...what were those issues?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
There are some older, unsupported elements, like a page view counter, that is no longer available. These elements will need to be removed as they cannot be made secure. Sitebuilder Plus will tell you if you have any unsupported elements on your pages.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
And, of course, I have page counters...on many, many, many pages. Will it ask me if I want the counters and if not, it will delete them automatically or am I going to have to go page by page beforehand and delete them?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
Unfortunately, no. You would need to go through your pages and remove them manually to be able to secure the site.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Great...

So when I try to republish will it tell me for each page all of the elements that need to be removed? And will it do it for all of the pages??
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 42,804 Points 20k badge 2x thumb
No, I'm sorry. It will just give a warning when you first open the builder that the following elements are not supported, and will list any elements you have. The page counter will not be among this list, but will need to be removed in order to have a secure site.
Photo of Brian7745

Brian7745

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled Secure Site.

I was needing to make our site secure in order to process transactions through PayPal. How do I go about doing that? It is very confusing.
Photo of Lori9869

Lori9869

  • 160 Points 100 badge 2x thumb
You have to open a free cloudflare account and change nameservers to point to your site.
Photo of S I Lanzet

S I Lanzet

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled certificate for website.

how do i get a trust certificate?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 43,876 Points 20k badge 2x thumb
Hello,

Please follow these instructions to secure your sitebuilder plus site.
Photo of dr9bob

dr9bob

  • 70 Points
I'm testing this procedure on an older less used site: GarWoodPegasus.homestead.com 
When I go to add the site I get the error : "Pleaser be sure you are using the root domain..." What am I doing wrong? Is Homestead the root domain?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 43,634 Points 20k badge 2x thumb
Hello,

That is a site name, not a domain. Unfortunately, this process can only be completed with a domain name.
Photo of dr9bob

dr9bob

  • 70 Points
Well, I completed the procedure on my medical office domain, AAFPC.net, which worked perfectly with https for 2 1/2 days then the domain went dead. Back and forth between Cloudflare and Namecheap about DNS, which never got resolved so I had to attempt to revert back to my original non-secure site. I did so after sever hours of changing settings, mainly DNS and forwarding on Namecheap BUT my email form page http://aafpc.homestead.com/Rx_Email.html_attempts to send a https request so the email doesn't go through. The corresponding email account, Rx@AAFPC.net, is working properly outside of Homestead. To test, the form the required fields will need any character in them. Once, I get the site back functional and stabilized I will still need to get it secure. We are in desperate need of assistance here as patient care is compromised.

Thank you for your help.

RMS, MD
A portion of our whois, the domain name servers appear correct, right?:
ech Name: WhoisGuard Protected
Tech Organization: WhoisGuard, Inc.
Tech Street: P.O. Box 0823-03411 
Tech City: Panama
Tech State/Province: Panama
Tech Postal Code: 
Tech Country: PA
Tech Phone: +507.8365503
Tech Phone Ext: 
Tech Fax: +51.17057182
Tech Fax Ext: 
Tech Email: 8bba54022a99468086c879d43e53d9c5.protect@whoisguard.com
Name Server: dns1.registrar-servers.com  
Name Server: dns2.registrar-servers.com
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 43,634 Points 20k badge 2x thumb
Those are not our nameservers, so I could not say if they are correct or not. If you were to call in and have one of our web advisors walk through these instructions with you, we could make sure it is set up properly.

1-800-710-1998

In regard to that domain, this is currently not working at all. I cannot see that this domain is pointing to Homestead in any way. You would need to at least be pointing to our IP address from your domain registrar.

1. A Record:   @       Points to:    108.167.135.108

2. CNAME:      *       Points to:    websites015.homestead.com

3. CNAME:     www      Points to:    websites015.homestead.com
Photo of Jeremy8076

Jeremy8076

  • 80 Points 75 badge 2x thumb
So I went through all of the steps to secure my site. When loaded from my laptop... it now has the https but still has the i with a circle around it and says the site is not fully secured. Any ideas..? 
(Edited)
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 43,876 Points 20k badge 2x thumb
This means there is an element on your page that is not secure. This is typically HTML that causes this, but it could also be a visitor counter on your site.
If you edit any HTML to include https in the links or remove any visitor counters and republish, your site would show fully secure.
(Edited)