Question re: http to https

[GetCarter]

I have a large http site - it's been up 25 years, so lots of pages/images with http addresses.

How much would I expect to pay someone with a brain and experience to make my domain https? And who should I be talking to?

(If I tried it, I would fail and the entire World Wide Web would probably crash)

TIA

[simon_harris]

isn't it just a case of ctrl H?

[Harpoon]

Do you know what platform your site is hosted on? Sometimes it can be relatively "easy" if there's a control panel like cPanel but could be worth speaking to your hosting provider if all this alien to you.

Don't let somebody try to charge for you the SSL certificate which underpins HTTPS - Let's Encrypt and Zero SSL both issue them for free. They need renewing every 90 days but that can be done automatically if setup correctly.

[GiantEnemyCrab]

You could set Apache / nginx to auto redirect any incoming links for http://getcarter.com/myimage.png to https://getcarter.com/myimage.png via HTTP 302. Should be totally transparent and need no link updating.

Although you coooould do a Find and Replace, but some stuff might not have valid HTTPS if you link to outside places (unlikely)

ETA assume you have some form of VPS setup with a web server (apache or nginx usually?)

[HantsRat]

Fairly easy to do and happy to have a look for free providing your hosting gives your free SSL Drop me a PM.

[GetCarter]

Thanks for all the replies... I'll speak to my hosting company and get the lowdown.

[Brother D]

If you register free with cloudflare, you can have it automatically redirect to https irc

[bitchstewie]

^^ that's what I would do if it's not a "simple" case of "dear hosting company please enable and enforce https".

Cloudflare will do this for free and will probably give you some other benefits.

[GetCarter]

Cheers, I'll check them out.

[Derek Smith]

My host did it for free and charges no additional maintenance.

[dimots]

Yeah usually free these days for a shared certificate. Or use cloudflare, takes two minutes to set up.

[anonymous-user]

Why do you want to do it?

[GetCarter]

MikeHo said:

Why do you want to do it?

Some people can't access my site as it's not https. And if I try and link to a photo online this is what happens:

[cw2k]

MikeHo said:

Why do you want to do it?

You get penalised by Google for not being https so if you are not https and your competitors are they will rank higher than you in searches.

You will also have the Not Secure in the address bar with http

[anonymous-user]

GetCarter said:

MikeHo said:

Why do you want to do it?

Some people can't access my site as it's not https. And if I try and link to a photo online this is what happens:

Interesting, over zealous security. It’s not like you’re submitting any data or such.

[Gary C]

Nice pictures

Our son is a composer for Rusty Quill (and others) & has moved to Scotland, loves it.

[jagnet]

MikeHo said:

Interesting, over zealous security. It’s not like you’re submitting any data or such.

But the site is leaving itself vulnerable to MITM content injection when unsecured. And that content could be anything, from annoying adverts added by your coffee shop's free WiFi service, to malicious JavaScript orchestrated by Governments annoyed that their citizens might bypass restrictions on what they deem acceptable viewing.

That's how China managed to DDOS Github using their Great Cannon attack tool - it weaponised visitors of unencrypted sites, inserting malicious JavaScript. Those visitors unknowingly became attack vectors.

No excuse not to be using https these days.

[GetCarter]

Thanks for the help chaps. All https sorted.