How to make an HTTPS connection? What is the difference between sites on HTTPS or HTTP?

In a global network, scammers and hackers are daily trying to steal personal information. In the past, the most popular method of kidnapping was considered phishing. The attacker replaces the original site, and data from the user fall into his hands (passwords, card numbers, private messages, etc.). To solve this problem, we created a secure HTTPS connection. Therefore, site administrators often worry about how to create and configure a secure https connection.

What is HTTPS and why is it needed ?

Before translating a site to an HTTPS connection, you should understand what it is and how it works. HTTPS is a secure version of the HTTP protocol (Hypertext Transfer Protocol), it transmits the necessary data for the operation of the pages (browser name, screen resolution, availability of cookies, etc.).

HTTP is used by developers to send and receive variables, without this protocol, the sites will not be able to function. All files transmitted via HTTP, could previously be easily intercepted using a fake site (phishing).

By this method passwords, logins, card numbers, secret messages and other important information were previously stolen. To protect users from phishing, the SSL certificates were invented and their authenticity checked before the exchange of information began.

HTTPS must be used on bank sites or online stores. If these resources do not have a digital certificate, the browser will disable the connection and a warning about the danger will be displayed. As a consequence, the site will lose the confidence of its users.

What is an SSL / TLS certificate?

The main innovation in HTTPS is the mandatory use of the digital SSL certificate. This is the file in which all the information is stored (the IP address of the server, the country of the site, the owner's e-mail, etc.). The digital document is encrypted on the site server and on the certification authority server (GoDaddy, Comodo, etc.). With each connection, these files are compared, and if they are the same, the connection continues. Otherwise, a security warning appears.

Many readers do not know how to make a secure connection https. The first step is to obtain an SSL certificate from a trusted center. There are different types of these documents:

• DV - only the domain is confirmed (for small sites and blogs).
• OV - domain and organization are checked.
• EV - extended check (a green bar and a lock in the browser will appear).

The most preferable for shops and banks is the EV option. Further there are additional specifications in the form:

• SGC (supports older browsers).
• Wildcard (subdomain support).
• SAN (alternative domains in one certificate).
• IDN (support of national www domains).

For most sites, it is sufficient to use the DV SSL certificate. It is inexpensive and guarantees protection from phishing.

How to translate a site to a secure connection

Increasingly, online business owners are interested in how to create a secure https connection. For these actions, you will have to make some changes to the code of the pages. The most important is to write an additional rule in the .htaccess file. It stores the code for configuring the Apache web server.

Most webhosts allow you to configure an SSL certificate for the server through the control panel. For more information on how to do this, contact your service provider. The whole process of site translation can be divided into the following stages:

1. Obtaining an SSL certificate.
2. Installing the certificate on the server.
3. Change of internal links of a site.
4. Configuring redirect to port 301.
5. Change Hosts to robots.txt.

If you use paid hosting of the beget type, then contact the support service with a certificate, and all further actions will be performed by the service employees. The most difficult step in answering the question of how to make an https connection is to configure the redirect .htaccess, since most scripts do not help.

Getting the certificate and installing it on the server

Theoretically, we figured out how to make an https connection, let's proceed to the actions. The first step is to get an SSL certificate from one of the tested centers. On the Internet, you can find many different options in a different price range. At the present time, to obtain a free document, there are 2 centers:

• WoSign.
• Startssl.

Other services require payment. The amount depends on the type of certificate and its additional features (multi-domain, support for old browsers, etc.). Certification Centers:

• Reg.ru.
• Godaddy.
• Hostland.
• Symantec.
• Comodo.
• GlobalSign.
• Thawte.

In addition, some hosting providers provide their users with SSL certificates when they purchase a certain tariff plan. The certification site details the necessary actions. But the whole procedure consists of the following stages:

• Generating the CSR request;
• Filling the site's mail (admin @ [site address]);
• Filling in information about the owner of the domain (for EV and OV document).

The CSR request includes general data for verification (domain name, organization, city, province, country). After filling in the information, the user receives 2 codes (secret key and CSR code), be sure to save them in a separate document. Send this code to receive an SSL certificate and wait for it to be issued from the center.

Now go to the hosting site and find the "SSL certificate" section or contact the support. It will be necessary to provide information about the CSR code, the private key and the certificate. Do not forget to enable SSL support in the hosting panel.

How to create an https connection on an ongoing basis

After placing the file on the server, you need to perform the internal configuration of the site. It will be necessary to set up a redirect and change all internal links from absolute to relative.

That is, instead of http://site.ru/img/bg.png set: //site.ru/img/bg.png.

It is necessary to remove HTTP from the names of links. If in doubt, then call a WEB-programmer or freelancer, he will quickly set it up. You can search for links through the code editor in each file or find all the information through the search in PhpMyAdmin.

After setting up the links, you need to tell the search engines about the change. Open the robots.txt file and in the Host line: put HTTPS instead of HTTP.

Instead of http://example.ru, paste: https://example.ru.

After changing the search file, we will configure automatic site redirection from HTTP to HTTPS. Before further action, check the availability of the site on the HTTPS protocol. If all past actions are performed correctly, then errors should not occur.

To automatically redirect to a secure connection, paste this script into an .htacess file, some help:

RewriteEngine on

RewriteCond% {HTTP: X-Forwarded-Proto}! Https

RewriteRule ^ https: //% {HTTP_HOST}% {REQUEST_URI} [L, R = 301, NE]

But in most cases this method does not work. In these situations, contact the hosting administrator, he will be able to make the correct settings. The redirect will start after the server is restarted, usually within 24 hours.

In addition, you will need to change the settings in the webmaster's panel "Yandex" or Google. It will be necessary in the indexing settings section to go to the main mirror point and install HTTPS. In addition, you will need to transfer:

• Sitemap.xml;
• URL exclusions;
• Geolocation;
• Links Disawov Tool for Google.

After this, it remains to wait for the end of reindexing. During this period, activity on the site will decrease, but then everything will stabilize.

How to make an https connection in WordPress

Modern blogs and portals mostly work on WordPress, they need to follow the same steps to get to https (get a certificate, change links, etc.). But they have a set of built-in plug-ins that will perform all the actions for the owner:

• Easy HTTPS Redirection;
• HTTPS (SSL).

The first replaces the references, and the second one allows you to specify the SSL certificate. In addition, go to the Settings-> General section. Here you need to change the URL and specify the HTTPS protocol. Make sure that the old pages also have a secure connection. After changing the links, redirect the configuration and change the robots.txt file.

There should be no more questions about how to make an https connection on the site. On most webhosts, to enable the protection mode, you only need to write to technical support. They will appoint a specialist, and he will perform the configuration.