Skip to main content
added 2 characters in body
Source Link
Neograph734
  • 8.4k
  • 2
  • 36
  • 61

The link to my content is lost So you enabled HTTPS and you can no longer see your Drupal website? It sounds like you have uploaded your Drupal installation in public_html and are not serving content from the private_html folder.

So you enabled HTTPS and you can no longer see your Drupal website? It sounds like you have uploaded your Drupal installation in public_html and are now serving content from the private_html folder.

If you are on a Direct Admin installation you can toggle the symlink private_html to public_html configuration That should make sure the correct files are served via HTTPS as well.

Enabling HTTPS

The rewrite rules that ship with Drupal are intended for mix-mode HTTPS (in which case your site supports both HTTP and HTTPS).

If you want the best security, just redirect everything to HTTPS. See the 3rd bullet point of Enabling HTTP Secure (HTTPS):

For best possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. Drupal 7's $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if the connection starts out as a HTTP connection before being redirected to HTTPS. Use the HSTS module or Security Kit module, or set the Strict-Transport-Security header in your webserver, and add your domain to the browser HSTS preload list, to help prevent users from accessing the site without HTTPS.

You may want to redirect all traffic from http://yourdomain.com and http://www.yourdomain.com to https://youdormain.com. You can do that by adding this to your .htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com*
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Put that below RewriteEngine on.

The link to my content is lost So you enabled HTTPS and you can no longer see your Drupal website? It sounds like you have uploaded your Drupal installation in public_html and are not serving content from the private_html folder.

If you are on a Direct Admin installation you can toggle the symlink private_html to public_html configuration That should make sure the correct files are served via HTTPS as well.

Enabling HTTPS

The rewrite rules that ship with Drupal are intended for mix-mode HTTPS (in which case your site supports both HTTP and HTTPS).

If you want the best security, just redirect everything to HTTPS. See the 3rd bullet point of Enabling HTTP Secure (HTTPS):

For best possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. Drupal 7's $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if the connection starts out as a HTTP connection before being redirected to HTTPS. Use the HSTS module or Security Kit module, or set the Strict-Transport-Security header in your webserver, and add your domain to the browser HSTS preload list, to help prevent users from accessing the site without HTTPS.

You may want to redirect all traffic from http://yourdomain.com and http://www.yourdomain.com to https://youdormain.com. You can do that by adding this to your .htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com*
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Put that below RewriteEngine on.

The link to my content is lost

So you enabled HTTPS and you can no longer see your Drupal website? It sounds like you have uploaded your Drupal installation in public_html and are now serving content from the private_html folder.

If you are on a Direct Admin installation you can toggle the symlink private_html to public_html configuration That should make sure the correct files are served via HTTPS as well.

Enabling HTTPS

The rewrite rules that ship with Drupal are intended for mix-mode HTTPS (in which case your site supports both HTTP and HTTPS).

If you want the best security, just redirect everything to HTTPS. See the 3rd bullet point of Enabling HTTP Secure (HTTPS):

For best possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. Drupal 7's $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if the connection starts out as a HTTP connection before being redirected to HTTPS. Use the HSTS module or Security Kit module, or set the Strict-Transport-Security header in your webserver, and add your domain to the browser HSTS preload list, to help prevent users from accessing the site without HTTPS.

You may want to redirect all traffic from http://yourdomain.com and http://www.yourdomain.com to https://youdormain.com. You can do that by adding this to your .htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com*
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Put that below RewriteEngine on.

Source Link
Neograph734
  • 8.4k
  • 2
  • 36
  • 61

The link to my content is lost So you enabled HTTPS and you can no longer see your Drupal website? It sounds like you have uploaded your Drupal installation in public_html and are not serving content from the private_html folder.

If you are on a Direct Admin installation you can toggle the symlink private_html to public_html configuration That should make sure the correct files are served via HTTPS as well.

Enabling HTTPS

The rewrite rules that ship with Drupal are intended for mix-mode HTTPS (in which case your site supports both HTTP and HTTPS).

If you want the best security, just redirect everything to HTTPS. See the 3rd bullet point of Enabling HTTP Secure (HTTPS):

For best possible security, set up your site to only use HTTPS, and respond to all HTTP requests with a redirect to your HTTPS site. Drupal 7's $conf['https'] can be left at its default value (FALSE) on pure-HTTPS sites. Even then, HTTPS is vulnerable to man-in-the-middle attacks if the connection starts out as a HTTP connection before being redirected to HTTPS. Use the HSTS module or Security Kit module, or set the Strict-Transport-Security header in your webserver, and add your domain to the browser HSTS preload list, to help prevent users from accessing the site without HTTPS.

You may want to redirect all traffic from http://yourdomain.com and http://www.yourdomain.com to https://youdormain.com. You can do that by adding this to your .htaccess file:

RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\.example\.com*
RewriteRule ^(.*)$ https://example.com/$1 [L,R=301]

Put that below RewriteEngine on.