Can I secure my Homestead Website with HTTPS?

  • 25
  • 53
  • Question
  • Updated 6 hours ago
  • Answered
  • (Edited)
For SITEBUILDER PLUS ONLY. Do not use if you have Website Builder.

If you have a Simplestore using Sitebuilder Plus, DO NOT PROCEED WITH THIS PROCEDURE.
For more information please read this topic
:

https://community.homestead.com/homestead/topics/sitebuilder-plus-simplestore-not-working-with-cloud...


Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propagate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.

*click on images to enlarge*

This topic addresses displaying a "secure" rating in the address bar. Currently your site shows an information icon to the left of your URL. If you click it, the message will say the site is not secure.


If you have a contact form this is important. As soon as you begin filling in a field in the form, the browser will display a more obvious message in the address bar.


To secure your site you will need to update your nameservers using Cloudflare. Below are detailed instructions on correctly configuring this so your website will be secure and your customers will feel more confident providing you their contact information.

1) Go to http://www.cloudflare.com and click on the sign up link.


2) Please enter your email address and password you wish to use for your Cloudflare account. If possible, please do not use an email address connected to your domain.
We strongly recommend you read the term and conditions. To continue you must agree to the terms and conditions by checking the box. If you agree, click on create account.


3) Enter your domain name and click on Add site


4) When the scan is complete, click next.

5) Select the FREE plan and click Confirm Plan.


6) Compare the DNS records Cloudflare scanned to your existing DNS records. They should match. If they do, click Continue.


If they don't, you can click on the name or value inside of Cloudflare that is incorrect and edit it. If you need help viewing your current DNS records, please see our topic, How can I view and edit my DNS records using Homestead nameservers.



NOTE: Please make sure to verify that the MX record has been added inside of CloudFlare's DNS settings. If you do not see a record with MX next to it, then we will need to add the MX record.


Click MX in the drop down, then click Name and type @, then Click to configure just right of that box. It will open a new window, please confirm your MX record.
If you are using email with Homestead, for server you will add mx.YOURDOMAIN.com, and for Priority you can put 10. Click save, then click Add Record.


7) Cloudflare will now provide you the new nameservers for your domain. If you do not see your nameservers, proceed to the DNS page inside of Cloudflare, and scroll down until you see Cloudflare Nameservers.

Important: When we update the nameservers, it is possible to see some interruption with the website and email as the settings propogate. This is to be expected, but if it has been more than 24 hours, please contact support and we can assist.



8) Log into your Homestead account and click the domains tab on the left. Under the domain you are working on, click Edit your nameservers. You will need to click delete next to ns3.mdnsservice.com and then change the other 2 nameservers to the ones provided by Cloudflare. You can't change and delete in the same step, so you will need to click edit twice.


9) Return to Cloudflare and click Continue.


10) The first part is now completed. Now, please review the Domain Summary and confirm that the SSL shows Flexible. If it does not, click the SSL option, and select Flexible.
(Note: you can also click Crypto at the top, then select Flexible with the drop-down menu on the right. This should save automatically after you select Flexible)


11) Over the next 24 hours, try manually typing in your site with https. If it isn't set up yet, you'll get an error page. Just type https://(www.yourdomain.com)  and when you see your site load with HTTPS, please proceed to the next step.


NOTE: Do not proceed to the next step until you can view your website when using HTTPS (https://www.yourdomain.com) When you see your site load with HTTPS, continue to step #12.

12) Click on the Crypto button at the top.


13) In the top section you should now see the status as Active Certificate. On the right side of that section, make sure it shows flexible. You now need to tell all http requests to forward to https. Scroll to the middle of this long page and look for the section entitled "Always use HTTPS" Turn it on. Also scroll to the bottom and find "Automatic HTTPS Rewrites" Turn it on


In a few minutes your all requests to you site will show secure.
If your site is not showing fully secure, please go republish your site.


Note: This solution is for Sitebuilder Plus sites only.
Photo of Homestead FAQ

Homestead FAQ, Employee

  • 41,996 Points 20k badge 2x thumb

Posted 1 year ago

  • 25
  • 53
Photo of roger8357

roger8357

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled How do I make my website show secure?.

My website shows not secure. Can you make it secure? http://www.shakesandpizza.com
Thank you.
Photo of BRENDAN5166

BRENDAN5166

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled We need help securing out website - it currently says it is not secure..
Photo of Todd H

Todd H, Social Media Specialist

  • 20,534 Points 20k badge 2x thumb
For Sitebuilder sites to be secure, please follow these step by step instructions.
Photo of chris0594

chris0594

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled how do I change my site to https.

convert my current site to https ?
Photo of martin7164

martin7164

  • 284 Points 250 badge 2x thumb
This reply was created from a merged topic originally titled my websites are not secure, can you fix this?.

websites aren't secure please fix this. 
Photo of Allan

Allan

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled Hi, I added a new page to my website with a few links to PDF's. Turns out this p....
Photo of Project6698

Project6698

  • 82 Points 75 badge 2x thumb
This reply was created from a merged topic originally titled Hi, my site is showing up as 'not secure'. How do I get this resolved?.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
This reply was created from a merged topic originally titled HOW DO I GET HTTPS.

HTTPS
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
To secure your site, you'll need to follow the instructions in this article
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
I am still using the desktop sitebuilder software
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
I see. Since you are using the desktop builder, you wouldn't be able to secure your site. I highly recommend you switch to Sitebuilder Plus at least, in order to secure your site
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
What are the steps required to do that
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
From Sitebuilder Plus, go into your File Manager, select all files, and click Upload. Then, log into your account at homestead.com, click Websites Manager, and choose Edit with Sitebuilder Plus
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Once I have done that then do I perform the procedure you mentioned above?

I will not have to go back and do anything further to the individual pages, right?

I will not be able to use the desktop editor any further, correct?

Is there any negative aspect going to the web based editor from the desktop version? It seems like I discussed this with tech support a while back and there was a real issue in changing, i.e. I would have to do something to each and every page?? 
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
Yes, once you've done that, follow the steps above for the HTTPS capability.
You should not have to do anything to every page, except republish the pages.
You should not revert back to the desktop editor after this has been done, as it can cause errors with your page and cause issue with the SSL

I cannot think of a negative aspect, aside from the fact that it is a little different than the editor you are used to using, so you may experience a learning curve.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Does the web editor have the capability to republish all pages? I have only seen a button to republish the current page.
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
Yes, if you click Publish from Sitebuilder Plus, it will ask if you want to publish all pages or current page. You can also do this from the File Manager. Click on your site name in the top right corner of the builder, click View File Manager, select all pages and click Publish.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
If I have any subfolders in File Manager do I need to also include them in the file selection to Upload?

Are there any known bugs in this conversion, i.e. are there things that are not going to convert correctly or may be screwed up? I have a LOT of pages on 2 websites...waaaay too many to think about having to correct on an individual basis if there is an issue
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
There are not any known bugs, but you are using really old technology. I cannot guarantee that all elements will translate 100% correct. Most or all of it should, though.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Wow...that's certainly not very reasuring, again, given the number of pages I have between my two primary sites. "Most" sounds like this could very easily turn into a disaster. I'm assuming you have had issues before since you cannot guarantee the accurate translation...what were those issues?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
There are some older, unsupported elements, like a page view counter, that is no longer available. These elements will need to be removed as they cannot be made secure. Sitebuilder Plus will tell you if you have any unsupported elements on your pages.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
And, of course, I have page counters...on many, many, many pages. Will it ask me if I want the counters and if not, it will delete them automatically or am I going to have to go page by page beforehand and delete them?
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
Unfortunately, no. You would need to go through your pages and remove them manually to be able to secure the site.
Photo of James0975

James0975

  • 192 Points 100 badge 2x thumb
Great...

So when I try to republish will it tell me for each page all of the elements that need to be removed? And will it do it for all of the pages??
Photo of Elyzabeth

Elyzabeth , Official Rep

  • 34,472 Points 20k badge 2x thumb
No, I'm sorry. It will just give a warning when you first open the builder that the following elements are not supported, and will list any elements you have. The page counter will not be among this list, but will need to be removed in order to have a secure site.