Chrome to start blocking downloads delivered over http protocol

For those of you still running stores that aren't https-enabled, this article might drive you to purchase that SSL certificate!

My read of the article is that yes sites that are trolled for downloadable content that is hosted without a SSL from a site that is hosted with SSL will be affected and a site that has SSL "enabled" but downloads without SSL (likely to only happen in such a situation by incorrect enablement of SSL, sites that are full hosted without SSL appear to be unaffected (for now)...

lat9:

For those of you still running stores that aren't https-enabled, this article might drive you to purchase that SSL certificate!

I'm finding it hard to believe that there still are people who didn't get an SSL cert... I mean, I know there are, but I just don't get it. Okay, back in the days when you had to get a small loan just to get an SSL cert, I understand. But nowadays, when you get a cert for $5 per year, when you don't need a dedicated IP (which used to be required so extra cost), and when you can even get a free cert, and when installing a cert is stupid-simple - why the hell are there still people running their stores without a cert??? :dontgetit:please:

balihr:

I'm finding it hard to believe that there still are people who didn't get an SSL cert... I mean, I know there are, but I just don't get it. Okay, back in the days when you had to get a small loan just to get an SSL cert, I understand. But nowadays, when you get a cert for $5 per year, when you don't need a dedicated IP (which used to be required so extra cost), and when you can even get a free cert, and when installing a cert is stupid-simple - why the hell are there still people running their stores without a cert??? :dontgetit:please:
I agree totally; just wanted those hold-outs to be aware that they're running out of time.

Noting also that this affects stores that ***have ***SSL certificates, but don't run SSL-all-the-time and provide downloaded files (like PDF forms) outside of the normally-SSL pages (e.g. account and checkout processing).

If you want a free https server you could try https://letsencrypt.org/ I used this for a few years before my ISP offers free SSL. It is a bit of a fag if you have to do the certificates manually but you are talking about a few minutes every 3 months. As my ISP did not support the automated process I set up my own server using virtual box) to generate the Certs and keys then transferred them to my live server.

We Rock are not offering Free SSL certs when you get your account, as having an SSL cert also helps your rank in google. Google has publicly stated that it. https://medium.com/@trendings/how-ssl-certificate-affects-seo-in-2019-dd88aa99885e

If your host does not provide free SSL's they are behind the times cPanel has an Auto SSL, its a feature that gives each website its own SSL. And it would be a good idea to force SSL all the time.

werock:

We Rock are not offering Free SSL certs when you get your account, as having an SSL cert also helps your rank in google.

:shocking:
Call me old-fashioned, but is this some modern-age reverse psychology marketing stunt or what? :D

I'm just kidding, but you really might wanna fix that typo... I know what you wanted to say, but... Damn, I have too much free time...

Rock on! :cheers:

werock:

We Rock are not offering Free SSL certs when you get your account, as having an SSL cert also helps your rank in google. Google has publicly stated that it. https://medium.com/@trendings/how-ssl-certificate-affects-seo-in-2019-dd88aa99885e

If your host does not provide free SSL's they are behind the times cPanel has an Auto SSL, its a feature that gives each website its own SSL. And it would be a good idea to force SSL all the time.

i am all for ssl certificates. but where has google publicly stated it? certainly not in the medium article that your reference. that article states that google has stated it, and even link to something about having a secure website, which again has nothing to do with google. and the guy that wrote that article hardly seems like the authoritative guy on the subject. he recently wrote an article on vaginal dryness. (i kid you not... is.gd/ikEEwW)

so call me a stickler, but if you are going to say that google has publicly stated it, i would like to see where, without searching myself. because from what i remember, their algorithm is highly guarded.

Google has publicly stated it.

https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html

(and yes, their algorithm is also highly guarded.)

swguy:

Google has publicly stated it.

https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html

(and yes, their algorithm is also highly guarded.)

great bit of information! thanks for the link, swguy....

i am for SSL everywhere; as most people on this thread seem to be. from that link:

"We've seen positive results, so we're starting to use HTTPS as a ranking signal. For now it's only a** very lightweight signal** — affecting fewer than 1% of global queries, and carrying less weight than other signals such as high-quality content — while we give webmasters time to switch to HTTPS. But over time, we may decide to strengthen it, because we’d like to encourage all website owners to switch from HTTP to HTTPS to keep everyone safe on the web..."

I'm gonna go waaaaaay off-topic, but...

carlwhat:

email is hard....

:rotflmao::bow:
Made my day!

balihr:

I'm gonna go waaaaaay off-topic, but...

:rotflmao::bow:
Made my day!

:D just brought a smile to my day as well. thank you!

So, I've used an SSL cert and https on my site for a good long time. I don't always understand it all, but I've thought it was all set up correctly. However, I'm getting emails from customers that their downloads are being blocked by Chrome. I ran a test, and sure enough. This article explains: https://blog.chromium.org/2020/02/pr...-insecure.html - specifically this:

*
Today we’re announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files. In a series of steps outlined below, we’ll start blocking "mixed content downloads" (non-HTTPS downloads started on secure pages).
*

So, my question is, how do I make the downloads secure? The files are zipped. The download page is secure. But how do I make sure the downloads use only https?

Three Sisters:

So, I've used an SSL cert and https on my site for a good long time. I don't always understand it all, but I've thought it was all set up correctly. However, I'm getting emails from customers that their downloads are being blocked by Chrome. I ran a test, and sure enough. This article explains: https://blog.chromium.org/2020/02/pr...-insecure.html - specifically this:

*
Today we’re announcing that Chrome will gradually ensure that secure (HTTPS) pages only download secure files. In a series of steps outlined below, we’ll start blocking "mixed content downloads" (non-HTTPS downloads started on secure pages).
*

So, my question is, how do I make the downloads secure? The files are zipped. The download page is secure. But how do I make sure the downloads use only https?

https://docs.zen-cart.com/user/installing/enable_ssl/

step 3. are your configure files correct as indicated there?

it does not look so on your site.

It's a real boondoggle. Looks like the entire site is absolute linking vs relative AND they are mixed - some www and some not.

Boondoggle me not! Switch from absolute URLs to relative by following this guidance;

https://docs.zen-cart.com/user/first_steps/relative_urls/

Thanks for the replies and the links... I'm taking time today to read and sort this out.

Thanks folks. Somewhere along the way, during upgrades or the SSL changes over the years, I had missed this change:

define('HTTP_SERVER', 'https://www.YOURSITE.com');

Pretty basic. Pretty humbled. Very grateful.

carlwhat:

https://docs.zen-cart.com/user/installing/enable_ssl/

step 3. are your configure files correct as indicated there?

it does not look so on your site.

Three Sisters:

Thanks folks. Somewhere along the way, during upgrades or the SSL changes over the years, I had missed this change:

define('HTTP_SERVER', 'https://www.YOURSITE.com');

Pretty basic. Pretty humbled. Very grateful.

:thumbsup: