I've used the following information to get mod_pagespeed to inject the GA scripts into my pages:
https://developers.google.com/speed/pagespeed/module/filter-insert-ga
Unfortunately we have a reverse proxy setup where the browser requests the page over HTTPS but the server injects the content as HTTP.
Here is the Chrome browser error:
[blocked] The page at 'https://*' was loaded over HTTPS, but ran
insecure content from 'http://www.google-analytics.com/ga.js': this
content should also be loaded over HTTPS.
I need this module to use the correct protocol when injecting the script i.e. https:// www.google-analytics.com/ga.js (Sorry for the broken URL I can't post more than 2 links)
We don't have an answer yet, but you can track progress of this bug here: https://code.google.com/p/modpagespeed/issues/detail?id=877
You are going to run into this issue a lot. Try fixing the proxy/server so it correctly identifies the end-user connection as SSL. Most Load Balancers inject a header and have an apache mod to read the header for you.
Related
Test URL = https://www.uktherapyhub.co.uk/info.php
Code is below
<?php include 'wp-load.php'; ?>
http://adrianmatthewstherapy.co.uk
Above is my code why it is adding the s in after http?
If i remove wp-load,php it works fine.
There's a chance server is programmed to redirect all http requests to https. You have to change server (adrianmatthewstherapy) configuration to allow http request and not redirect them.
If website is configured for HTTPS, you might need to change the other links to follow the secure connection. Specially I've observed google chrome (Version 80.0.3987.122) is converting all the internal links (audio src) to https.
A good reading:
https://support.google.com/blogger/answer/6286127?hl=en
I have moved my Joomla website from one hoster to another and on the new hoster I get:
Blocked loading mixed active content "http://mywebsite.com/joomla/media/jui/css/bootstrap.css"
I understand the reason: I use https, and browser detects a http call.
But how do I fix this?
You change the source of your https website to point to the https version
If you can't, you can fix it for moden browsers with that http header:
Content-Security-Policy: upgrade-insecure-requests
See https://scotthelme.co.uk/migrating-from-http-to-https-ease-the-pain-with-csp-and-hsts/
Note: to improve security, you should use HSTS. It will redirect http to https directly in the browser, without insecure redirect.
Specifically about joomla:
Did you set
$live_site = 'https://www.your-domain.com';
in your configuration.php file ?
See https://www.joomlart.com/tutorials/joomla-tutorials/how-to-use-ssl-in-a-joomla-site
I recently installed SSL from CloudFlare Flexible SSL but when I use https it doesn't seem to load image and CSS assets.
I already disabled hotlink protection.
Here are some images to illustrate the difference:
Using https: http://gyazo.com/ef6ccb13c2c8f3f797dcb2d947a772cb
Not using https: http://gyazo.com/be277259e0dcc8e395316b573de12935
Thankful for help!
A look at the browsers console shows lots of messages like this:
Mixed Content: The page at 'https://hornetvault.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://www.hornetvault.com/templates/fresh/assets/css/styles.css'. This request has been blocked; the content must be served over HTTPS.
Which means you try to load resources using http:// inside a https:// site and these resources get blocked. You need to load these resources by https:// too. You might try to simple use // instead of explicitly given http:// or https:// in your URLs, in which case it will simply use the same scheme (http or https) as the page itself.
I'm thinking about my website architecture that's using https.. I now have a CDN server hosting images , css and more static files.
The website itself is using HTTPS for securing sensitive costumer data. Will using the static images , loaded by for example 'http://cdn.example.com/images/test.jpg' on a website 'https://www.example.com' popup a "Loading insecure data" message?
So loading external NOT SECURED data on a SECURED website.
Will this be causing a popup warning "Loading insecure data, continue?"?
Thx!
Yes.
If a page is loaded over HTTPS then every resource it uses should also be loaded over HTTPS.
Otherwise a man-in-the-middle could replace images with misleading ones (or ones that exploit buffer overflow issues in browsers to execute code) and scripts with ones that do different things (such as leak data to the third party).
You have to load every resource over https to get rid of that warning. You can either move the resources to your server that supports encryption, or link to an external resource over https.
If you really want to load http content in https, you can follow this method using a backend handler in charge of downloading and exposing the required content with self forged links including a hash. The security issue is then fixed and you get the content accessible through https.
Dealing with HTTP content in HTTPS pages
I did this recently.
I have a raspberry pi loaded with nginx, and PHP.
I us Https to handle requests from the web to the PHP code which in turn sends http requests to my local network to assemble the page. Works well.
I have a site https://mysite.com which deals with various portlets, gadgets. One of the gadget must be referring to http instead of https.
I would'nt know which one just by view source I want to use fiddler. Can some one explain me how do I use it to track http reference?
Sure. Boot up Fiddler and enabled HTTPS decryption. Then visit your site and let the page load. Then look at the Protocol column in Fiddler's main session list. One of them will say HTTP instead of HTTPS.