Moved: Add HTTPS/SSL to a Site

[lcthree]

Once I have a site that's already up and running, what changes do I have to make to secure it so that any HTTP requests are rejected, all pages (except the index) must be accessed via HTTPS. Obviously I have to change all of the hyperlinks to https://, but apart from that what do I need to do?

Note: I'm refering to a professionally hosted site which will already have any necissary SSL modules for Apache/PHP is necisarry installed and enabled, I just need to know what changes to make to the PHP so it says no to any unsecured requests other than the index. And do I need to get a digital cirtificate?

[nathj]

This is often a lot less complicated than you might think.

I had a site hosted that needed to use SSL on all pages (a bit easier) and all I had to do was ask the host to provide the certificate and the code for my .htaccess file. This last bit is simply a command to inform the server that you are using the secure server.

With that in place it was all sorted.

There's nothing you need to do in PHP as far as I am aware. I think your next stop should be contact your host and ask them about it. If they're any good you should be sorted very quickly.

Also, as you say, any absolute paths will need to be updated.

Cheers
nathj

[developing]

nothing.

ssl is a server issue. its got nothing to do with the runtime application. all you need to worry about are the links that point to your site as they will have to be changed from 'http' to 'https', which you already did

[lcthree]

Okay thanks, I'll do that. :)

[pbmods]

Moved to the Apache forum.

[lcthree]

I have a follow-up question: If I am using AJAX on an HTTPS page and make an asyncronous request using a relative URL such as "../test.php", will it resolve to an HTTPS request or a standard HTTP request? Do I have to change my AJAX in any way to make the asyncronous requests secure?

[nathj]

I think, that if the URL in the AJAX request is absolute then you may need to make the protocol HTTPS. However, if it is a relative path you should be okay.

That said there may be other factors involved, such as the server set up for the certificate. this is my LIMITED understanding.

Cheers
nathj