Make entire site SSL Only

[tbohannon]

Thank You!

Ok...changing all HTTP references to HTTPS in the 2 configure.php files fixed it!. I guess I did not understand the responses to direct me to make this simple change.

So with all the documentation I have seen on Google and this forum there is no mention of making sure that all HTTP references are changed to HTTPS. The guidance is to point HTTP > HTTP and HTTPS > HTTPS...so is required to point all HTTP/HTTPS references to HTTPS because I was Forcing SSL in my .htaccess file?

[mc12345678]

Thank You!

Ok...changing all HTTP references to HTTPS in the 2 configure.php files fixed it!. I guess I did not understand the responses to direct me to make this simple change.

So with all the documentation I have seen on Google and this forum there is no mention of making sure that all HTTP references are changed to HTTPS. The guidance is to point HTTP > HTTP and HTTPS > HTTPS...so is required to point all HTTP/HTTPS references to HTTPS because I was Forcing SSL in my .htaccess file?

So, the general consensus around here is that just because one search engine has adopted a particular view (the effect of which supposedly remain to be proven) does not mean that it need be adopted. But as to specifically what was going on, I can't say I know exactly how to explain the background details (assuming I knew them all to begin with) but can say that it seemed wrong that if I wanted https to appear everywhere that http was presented to "not" change the setting(s) in the file that has http: :)

Also, and I've seen a few threads in the last couple of days about this choice, but if not mistaken it is possible to tell google via webmaster tools that https: and http: pages are the same thing/site as part of this whole thing so that there is no SE "confusion". Anyways, glad it worked for you. Yes, some people need the "code" in front of them while others need it explained in words instead. :)

[frank18]

https://www.bodhisattva-store.com/listings/
ZC 1.5.0
Hosting on GoDaddy VPS
Dedicated SHA-2 SSL certificate to: www.bodhisattva-store.com managed through GoDaddy

Added Forced SSL rules in .htaccess file...these are the only rules in the .htaccess file:
#Force SSL on entire site
RewriteEngine On
RewriteBase /
#RewriteCond %{ENV:HTTPS} !on [NC]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://bodhisattva-store.com/$1 [R,L]
......

There is no need to force SSL in your .htaccess file, ZC takes care of this in the 2 configure.php files.

BTW, you should seriously consider upgrading your installation to the latest version.

[mc12345678]

I also forgot to mention, it would seem that it is also time for you to change your admin directory name as it appears to have been published when posting the admin configure.php file (path to tell us it was the admin version.)

[tbohannon]

There is no need to force SSL in your .htaccess file, ZC takes care of this in the 2 configure.php files.

BTW, you should seriously consider upgrading your installation to the latest version.

Frank18,

Thanks for following up.

Yes agreed and we will be upgrading soon.

With regards to removing the Force SSL....if I remove that from .htaccess the site no longer shows https at the store level...only when I go to checkout.

So eager to hear how I can Force SSL on entire store if there is no need to put rules in .htaccess.

[tbohannon]

mc12345678,

Thanks again for making this more clear.

So going to ask, is renaming the admin area as simple as renaming the folder on the server, or do I have to make code changes to the
store or theme?

[tbohannon]

So, the general consensus around here is that just because one search engine has adopted a particular view (the effect of which supposedly remain to be proven) does not mean that it need be adopted. But as to specifically what was going on, I can't say I know exactly how to explain the background details (assuming I knew them all to begin with) but can say that it seemed wrong that if I wanted https to appear everywhere that http was presented to "not" change the setting(s) in the file that has http: :)

The driver for this was not so much from Google's http/https identity crisis, as much as it was buyer concern over not seeing a padlock as soon as they
land on the site.

Several customers had called because they did not see a green padlock in Chrome, etc.

[frank18]

Frank18,

Thanks for following up.

Yes agreed and we will be upgrading soon.

With regards to removing the Force SSL....if I remove that from .htaccess the site no longer shows https at the store level...only when I go to checkout.

So eager to hear how I can Force SSL on entire store if there is no need to put rules in .htaccess.

Store side configure.php

define('HTTP_SERVER', 'https://www.bodhisattva-store.com');
define('HTTPS_SERVER', 'https://www.bodhisattva-store.com');

Admin configure.php

/**
* WE RECOMMEND THAT YOU USE SSL PROTECTION FOR YOUR ENTIRE ADMIN:
* To do that, make sure you use a "https:" URL for BOTH the HTTP_SERVER and HTTPS_SERVER entries:
*/
define('HTTP_SERVER', 'https://www.bodhisattva-store.com');
define('HTTPS_SERVER', 'https://www.bodhisattva-store.com');
define('HTTP_CATALOG_SERVER', 'https://www.bodhisattva-store.com');
define('HTTPS_CATALOG_SERVER', 'https://www.bodhisattva-store.com');

Set all URL's to https: and that should do the trick.

[tbohannon]

frank18,

Thanks for re-confirming the changes I made to clear the 2 issues I originally posted about.
I set all http references to https as you suggested.

So my remaining issue now is you say I can remove the Force SSL .htaccess rules, but when I do remove the rules
store level is no longer protected, only when checking out.

[frank18]

frank18,

Thanks for re-confirming the changes I made to clear the 2 issues I originally posted about.
I set all http references to https as you suggested.

So my remaining issue now is you say I can remove the Force SSL .htaccess rules, but when I do remove the rules
store level is no longer protected, only when checking out.

Did you clear the cache of your browser or used another browser? If not, that could be the issue.