How do I simply make the whole site use a secure connection? [closed]

Question

In Drupal 7, I used the Secure login module to run the site on a secure connection, but it seems it doesn't revert back to http on logout. I would like to just run the whole site as https:// as a simplification.

Is there a simple way to do this without the use of module?

Answer 1

Start by reading Enabling HTTP Secure (HTTPS). Please ask more specific questions and/or update your question if that doesn't help.

Answer 2

If you want to redirect all of your pages to be forced to use SSL then add this to your .htaccess file.

# Redirect to HTTPS
RewriteCond %{HTTPS} off
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

This should be placed directly after RewriteEngine on if you have no previous rewrites.

Answer 3

Another handy trick, if you have root access to Apache to alter your vhost directives is to add this to the SSL directive for the site. Most modern browsers obey this directive (IE9 does not)

Header always set Strict-Transport-Security "max-age=63072000"

You can set the age to whatever you want. What this does is inform web browsers that obey this to ONLY use SSL to communicate with your website and never plain HTTP. This adds a little bit of assurance with the whole HTTP/HTTPS switching situation.

It's a handy hack.

NOTE: This will only work if you have a VALID SSL certificate (not self-signed, expired or otherwise incorrect) on your site. If you don't, it will prevent the browser from connecting to it until the max-age period expires.

Answer 4

There is another option you may wish to try—it's what I needed for one of my installs, and it required no additional modules:

First, in your .htaccess:

RewriteCond %{HTTPS} !on
RewriteCond %{HTTP_HOST} ^www\.yourdomainhere\.com*
RewriteRule ^(.*)$ https://www.yourdomainhere.com/ [L,R=301]

This should be added after:

RewriteEngine on

Then, in your settings.php:

$base_url = 'https://www.yourdomainhere.com'; 

Also, you may want to check for external resources, such as Web fonts and other references that need to be coming from an https domain in order to avoid certificate warnings.

Hope this helps.