Switching from http to https in regards of vBSEO

Hi, I have been searching around here for a while but I have a couple of questions, I am sure you can clarify and help me .

I intend to switch from http to https (I already have a certificate). I of course run vSBEO and MaxCDN. My htaccess looks as follows:

Code:

RewriteCond %{HTTP_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$)RewriteRule (.*) http://www.cureconnections.com/$1 [L,R=301]


RewriteRule ^((urllist|sitemap_).*\.(xml|txt)(\.gz)?)$ vbseo_sitemap/vbseo_getsitemap.php?sitemap=$1 [L]


RewriteCond %{REQUEST_URI} !(admincp/|modcp/|cron|vbseo_sitemap)
RewriteRule ^((archive/)?(.*\.php(/.*)?))$ vbseo.php [L,QSA]


RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !/(admincp|modcp|clientscript|cpstyles|images)/
RewriteRule ^(.+)$ vbseo.php [L,QSA]

What would you recommend, what is the right way to perform that switch? Use the htaccess or the vSBEO rewrites in the panel? What are the correct changes and/or additional rewrites I have to add to any of them to use https globally for my website and make everything work correctly in regards of vBSEO?

And of course: what should I do to avoid any negative impacts on SEO and rankings? Will there be any at all if I redirect correctly?

Do you have any other recommendations on what I should think of and take care of? Thank you very much in advance!

Moving to https may trigger a complete re-index of your site. I haven't done it, so I can't say for sure what will happen. Personally, I don't buy into the whole site needs to be on a secure connection. It's vastly slower at the server level too.
Only login pages and admin really needs to be secured.

I'm aware of the whole people on public wifi can steal your session/etc, but the fix is not on everyone's website-- it's on your insecure connection in the first place. Seems completely backwards to me, addressing the problem from the wrong end of the spectrum. "I'm bleeding, therefore I got xrays"

Code:

RewriteCond %{HTTPS} off 
RewriteRule (.*) https://www.mysite.com/$1 [L,R=301]

is really all you need to redirect http to https. That should come first directly after rewrite engine on.

Of course, wyou need to update your vb url in vboptions.

Thanks a lot for your advice Brian. I understand your point of view and have to admit, I am not entirely sure if it's a good idea to switch. From what I have been told my forum shouldn't be significantly slower on that kind of powerful server I have, but well, that could be wrong of course.

I will have to sleep one ot two nights about it. I already bought the certificate, maybe that was a bit overhasty as I had to pay for two years in advance...

I just have one more question about the change in the htaccess you posted:

Code:

RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.mysite.com/$1 [L,R=301]

Mine currently is:

Code:

RewriteCond %{HTTP_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$)
RewriteRule (.*) http://www.cureconnections.com/$1 [L,R=301]

That's based on the settings for the CDN and following this of your stickies: [How to] Setup www.yourdomain.com or yourdomain.com (www vs. non-www) - With .htaccess 301 redirects. Which means so far I forwarded domain.com to www.domain.com. Wouldn't I lose these settings? Or would it be correct to change it to:

Code:

RewriteCond %{HTTPS_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$)
RewriteRule (.*) https://www.cureconnections.com/$1 [L,R=301]

But then the "off" you posted isn't included.

Thanks a lot for your support!

Where are you getting the HTTPS_HOST variable from? To the best of my knowedge, this does not exist.

in full play, the best way would probably be

Code:

RewriteCond %{HTTP_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$) [OR]
RewriteCond %{HTTPS} off
RewriteRule (.*) https://www.cureconnections.com/$1 [L,R=301]

untested, of course

Where are you getting the HTTPS_HOST variable from? To the best of my knowedge, this does not exist.

Sorry, I was just guessing.

If I decide to do the switch I will use your recommended code (of course ;-)). Thanks!

If you like I can summarize a little experience here right after, just in case other vBSEO users might want to do the same.

Sorry Brian, I need to get to back to this as I still have to questions .

First, you posted

Code:

RewriteCond %{HTTP_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$) [OR]
RewriteCond %{HTTPS} off
RewriteRule (.*) http://www.cureconnections.com/$1 [L,R=301]

Shouldn't line 3 be

Code:

RewriteRule (.*) https://www.cureconnections.com/$1 [L,R=301]

as you posted before?

And does this cover the redirect of

Code:

http://cureconnections.com

and

Code:

http://www.cureconnections.com

to https? I will need this to forward all existing links to the new https URL, right? Or should I do this in the redirect section of the vBSEO panel (if so, what would I have to enter please)?

I found out that in Google webmaster tools you can move a web from one domain to another, Google says it would help to smoothen the transition. Would you recommend to do this or just work with redirects and wait until it's properly re-indexed again?

Thank you very much!!

yes and yes. sorry about that.

Code:

RewriteCond %{HTTP_HOST} !(^www\.cureconnections\.com$|^cdn\.ccc\.cureconnections\.netdna-cdn\.com$) [OR] 
RewriteCond %{HTTPS} off 
RewriteRule (.*) https://www.cureconnections.com/$1 [L,R=301]

is

the correct code.



I should also mention, that you may see massive "page contains both secure and non-secure items" warning messages for everything loaded by the cdn (unless you can serve that via https, which i'm not sure is possible as you have it without a cname) and any inline images/etc that users post from 3rd party sites will all be http-based, and pop that warning up as well.

Thanks Brian!

So that's another big oh-oh... You're right about the cdn, unfortunately my host doesn't allow me to cname. Which means if I'd really stick with my https idea I had to abandon the cdn. That's pretty much of a no go for me, against the https.

How is vbulletin.com handling this? They had some troubles in the beginning but now everything seems to work fine, also the hotlinked images.

Not sure... will have to ask them.

Additionally, it seems that the whole move to SSL to prevent eaves dropping on the open wifi, has failed.


So, i continue to have a 'there's no point' to ssl on the entire site mentallity.

Don't do stuff that you need to login for on a public network if you're THAT concerned about your forum account being hacked. OH NO! someone posted as me!!!!!!!!!! it's not the end of the world.

To be honest, the wifi idea was never the reason for me to start the whole idea. The other points you mentioned are making me think I acted overhasty by already ordering the certificate...

ask first, buy later

Hey Brian, Would not SSL ( https ) help stop bad bots, hackers, etc...also?
Just a question, as I was also thinking of switching to SSL myself. ( Because of reasoning stated above....lol )

Thanks Mates, Brian R. Wallace

SSL won't stop anyone from viewing a site, so bots will likely be unchanged.
Hackers may have a bit more diffuclty, but the vast majority of hackers aren't hacking the packets.... they are using sql injection or other code runs on the server it self. https won't stop or change that.

Sorry to bump on this thread but could you share how did you setup SSL on some parts of vBSEO.com?