Forcing the use of HTTPS:// on your site

[rnedelkow]

Does anyone know how to enforce https on a Windows server? It seems Linux systems can just add code the htaccess file but the process differs for Windows.

[willie53]

In your web.config insert the followng code

<rule name="HTTP to HTTPS redirect" stopProcessing="true">
  <match url="(.*)" />
    <conditions>
      <add input="{HTTPS}" pattern="off" ignoreCase="true" />
    </conditions>
  <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
</rule>

[rnedelkow]

I tried the following in core/includes but it still shows unsecured content:

<!--
    This file is for IIS to block direct access to this directory to the webserver.
    This will not affect Apache (which has similar rules in the .htaccess file in this
    directory
-->
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
  <rewrite>
            <rules>
                <rule name="HTTP to HTTPS redirect" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" redirectType="Found" url="https://{HTTP_HOST}/{R:1}" />
                </rule>
            </rules>
        </rewrite>
    <handlers>
      <add name="Deny" path="*" verb="*" type="System.Web.HttpForbiddenHandler" />
    </handlers>
  </system.webServer>
</configuration>

[glennrocksvb]

I believe it should be in web.config file in the vB root directory.

[rnedelkow]

Thanks, I'll give it a shot.

[rnedelkow]

Just to confirm, even if the site has a valid certificate and vBulletin options are set correctly, will adding an unsecure image to a module and displaying it on the homepage cause a mixed content message?

[willie53]

yes it will make sure all images has https instead of http
Then try to find the images causing the the lock at the address bar not turning green saying it is secure is to click on the lock the go to more information select media this will show the image that is causing the problem

[glennrocksvb]

For user-generated content, it is inevitable that users would link to images using http and that will cause mixed content warning. To prevent that, you can block all mixed content

https://vbmods.rocks/forum/vbulletin-5-modifications/vbulletin-5-miscellaneous-modifications/4207-block-mixed-content-prevent-ssl-breaking

[rnedelkow]

willie53 glennrocksvb thanks again.