Secure connection, what to do?

osgood_  wrote This gets even more insane now I have had a better chance to check the majority of the websites I manage. Some seem to have a SSL certificate associated with them, which until now I didnt know about, so I have no idea how they got those certificates unless they came as part of the hosting package by default............hummm.

Many providers now have a ssl certificate provided as default, previously this was associated with a specific folder within the site, but it is becomming more common for the server site root to have 2 seperate root folders, one for none https, and one for only https.

osgood_  wrote If I use https to access the pages parts of them are designated as unsecure, I guess those links not using the https:// protocol....its all a bit of a mish mash to me when it comes to using a secure connection.

Secure sites start with the site itself -

• You cannot have any links to any assets such as image, css, javascript, video files outside the secure folder itself.
• If you are using any server side code, it must also be within the secure folder, plus you should ensure it checks for a secure link if it is being used to access a database or information/resources not on the same secure server.
• Any external links such as to jQuery or a cdn must be a secure connection. Simply changing the links to https does not work, especially if you are linking to an older version of a resource. The server the resource is hosted on, must respond with the correct response code too the browsers request, to indicate a valid ssl certificate, if the response code for the file itself is not considered as secure it is possible that it will not load at all, (see my post about problems connecting to the forum and web fonts) though this will depend on the isp's settings.
• Browser settings offer the possibility to notify the end user of a questionable, expired or revoked certificate, unless this setting is changed by the end user, in which case only the brocken padlock will show.

Those are the main points, and are only a small example.

For the first item, information being intercepted over the internet, this is the real reason for ssl/https. Such interceptions though are rare, as they require direct hacking of the servers involved or slicing into the network. It's worth remembering though, that https will give the site a higher search engine ranking if the entire site is placed within the secure folder. So there could be a positive involved with the cost of doing sites using https by default.

The only item I would recommend regarding the info, is to encrypt the email address on the database, as this is generaly regarded as sensitive info. I don't know about Australia, but in Europe the loss of such data would certainly incur a fine if stolen from the database. The rest of the user data would depend on the 'all reasonable precautions taken', being proven by yourself and the site owner, for which the use of ssl will certainly be an advantage.

One other item to remember is not to do a wordpress for the log-in page, i don't know if they still do it, but if one had the log-in info wrong, it would tell the user which one was incorrect, which is a definite do not do. An hacker in such circumstances would then know which item was correct, and could then concentrate on the incorrect item. Always use a general message that says the info is incorrect.