{"id":136362,"date":"2015-01-27T08:00:20","date_gmt":"2015-01-27T13:00:20","guid":{"rendered":"http:\/\/premium.wpmudev.org\/blog\/?p=136362"},"modified":"2019-04-26T16:54:55","modified_gmt":"2019-04-26T16:54:55","slug":"ssl-https-wordpress","status":"publish","type":"post","link":"https:\/\/wpmudev.com\/blog\/ssl-https-wordpress\/","title":{"rendered":"How to Use SSL and HTTPS with WordPress"},"content":{"rendered":"

Everyday we give away our\u00a0personal information on the internet. In the past hour alone I paid off my credit card, bought a book, saved a copy of my friends’ addresses, sent out emails and did some grocery shopping.<\/p>\n

Sharing our information is so common now that we don’t think twice about it.<\/p>\n

This is where SSL comes in. SSL protects the details we share online,\u00a0preventing it from getting into the wrong hands.<\/p>\n

Using SSL \u2013 and in turn HTTPS \u2013 to protect your WordPress site and its visitors doesn’t have to be difficult and complicated. In this post we’ll look at what SSL is and how to use it. Let’s break it down.<\/p>\n

What is SSL?<\/h2>\n

SSL (Secure Socket Layer) started out as a method for increasing security between a website and its end user in 1994 by Netscape Communications as they saw the need for this technology increase.<\/p>\n

\"The
The Internet Engineering Task Force (IETF)<\/figcaption><\/figure>\n

SSL was later revised and released for the first time as version 3.0 in 1996, but contained vulnerabilities. It was officially taken over by the Internet Engineering Task Force (IETF) in 1999 and was vastly improved.<\/p>\n

At this point, SSL was renamed to TLS (Transport Layer Security), but it’s still widely referred to as SSL or TLS \/ SSL. Its purpose remains the same to this day and the technology has become the standard for website security.<\/p>\n

When Should You Use SSL?<\/h2>\n

Last year Google announced giving search ranking boosts<\/a> to sites using SSL. Over time the search engine plans to increase this\u00a0boost, but in the meantime you’ll only see about a 1% increase, giving everyone a chance to switch over.<\/p>\n

Other than that, if your site requires users to log in or provide personal information such as their name, address, credit card details\u00a0and the like, you need SSL protection. Without it, your user’s information can be easily compromised.<\/p>\n

How Does SSL Work?<\/h2>\n

SSL works by encrypting information passed between a site’s server to the browser rather than having it remain viewable in plain-text, meaning text would be arranged in a seemingly random string of illegible\u00a0letters and numbers rather than in human-readable words.<\/p>\n

To create a secure SSL connection on a website, the site’s owner needs to get an SSL certificate from an issuing company, referred to as a Certificate Authority. Once the service is purchased, the website and company details are given to the authority such as their name, address and phone number.<\/p>\n

\"Some
This is some of the information required to register for a basic SSL certificate. Other more secure certificates are more involved.<\/figcaption><\/figure>\n

In turn, the site owner receives a public and private key. The private key shouldn’t be shared with anyone \u2013 much like a password \u2013 but the public key doesn’t have to remain perfectly hidden.<\/p>\n

They are a string of cryptic letters and numbers that distinctly fit together mathematically\u00a0\u2013 like a matching key and lock! They are created by a Secure Hash Algorithm.<\/p>\n

The public key is then submitted with your previously entered information to the authority in a file called a Certificate Signing Request.<\/p>\n

\"A
Public and private keys are entered into WHM (in this example) to be verified by the Certificate Authority.<\/figcaption><\/figure>\n

The authority verifies the information to make sure it’s accurate \u2013 and that you’re not a scammer or hacker\u00a0\u2013 and if everything checks out, the SSL certificate is signed with an SHA.<\/p>\n

The actual SSL certificate is then issued. This is the stage where a website is now able to use an SSL-encrypted connection.<\/p>\n

When a user visits a protected site, the site’s server matches its SSL certificate with the private key and when it fits together, an encrypted link between the site and its server, and the user and their browser, is created.<\/p>\n

What Does an SSL Protected Site Look Like?<\/h2>\n

The prefix https<\/em> will appear in front of a URL rather than the default http<\/em>. You will also notice a green padlock appear in the address field of your browser.<\/p>\n

\"SSL
This is what a site with SSL looks like in Google’s Chrome browser. The padlock differs in various\u00a0browsers.<\/figcaption><\/figure>\n

If a site has chosen to purchase an Extended Validation SSL Certificate, your address bar will be entirely green or will have the company’s name with a green background appear before the URL.<\/p>\n

\"EV
This is an example of an EV SSL certificate in the Safari browser. The address bar isn’t completely green and the company name does not have a green background like other browsers, but instead, uses a green font.<\/figcaption><\/figure>\n

Extended Validation Certificates typically offer more security and are issued once the company has gone through and passed a more thorough application process. They are asked to provide proof of their physical address and legal operation on top of the standard requirements.<\/p>\n

When SSL Stops Working<\/h2>\n

If an SSL certificate has expired, is self-signed or becomes invalid, the padlock turns red and sometimes has a line through it as well.<\/p>\n

\"An
Most browsers will launch a page that warns you of invalid SSL certificates before you continue to an untrusted site.<\/figcaption><\/figure>\n

When the certificate has expired, the site owner simply needs to renew their SSL through their authority and the encryption will be renewed. It’s best not to let them expire at all to keep the security of your site seamless.<\/p>\n

You are using a self-signed certificate if you applied for and issued your own SSL certificate and you did not go through a Certificate Authority for them to validate you or your certificate.<\/p>\n

Most browsers only trust SSL certificates handed out by trusted Certificate Authorities and will display a warning for all sites using a self-signed certificate.\u00a0If you have purchased an SSL certificate from a company that is not a high ranking Certificate Authority, your site may still be recognized as using a self-signed certificate.<\/p>\n

\"A
Most browsers will also warn you when a site’s SSL certificate has expired before proceeding to the unprotected site.<\/figcaption><\/figure>\n

An SSL certificate may\u00a0become invalid for many other reasons, such as if the SHA encryption is outdated.<\/p>\n

Hashing is the conversion of a lot of information written as characters into a shorter size often referred to as a key and it is done through a\u00a0set of mathematical rules that are applied. As technology advances, stronger hashing is necessary to keep security strong.<\/p>\n

SHA0 is no longer used and SHA1 is being phased out by many browsers including Internet Explorer. Chrome will begin to issue warnings starting January 1, 2016 for sites who still use SHA1. The current standard for encryption is SHA2 which will eventually also be phased out in favor of SHA3.<\/p>\n

An SSL certificate can also appear to be invalid if the browser cannot verify it with the authority. This can happen if the domain name of the certificate does not match the actual site which is using it.<\/p>\n

The best way to resolve these issues is to update your SSL certificate with your authority and follow their instructions.<\/p>\n

\"A
One of my sites has images that are still linked under the http prefix and so the SSL certificate is not completely\u00a0safe. The address bar shows a yellow yield sign in the Chrome browser.<\/figcaption><\/figure>\n

If a yellow padlock appears with a mini yield sign, the likely cause is\u00a0links in your site still refer to an unsecured page. Make sure that all your images, menu items and links use https<\/em> in the URL.<\/p>\n

To easily find the source of an invalid certificate you can use the free tool Why No Padlock<\/a>. It instantly\u00a0informs\u00a0you of\u00a0the specific problem including invalid images and scripts.<\/p>\n

Using SSL with WordPress<\/h2>\n

Once you have your SSL certificate ready to go you can use it with your WordPress site.<\/p>\n

Don’t forget to backup your entire site before you make any changes to prevent you from losing everything if something goes wrong. Once that’s done you can continue.<\/p>\n

To set up SSL in both a single or Multisite install, first edit your wp-config.php<\/em> file and add the following line of code. It will force both<\/em> logins and access to the WordPress admin area to use SSL:<\/p>\n

Loading gist jennimckinnon\/78c784c6818cf563fb75<\/a><\/p>\n
\n

Please update your cookie preferences<\/a> to enable preference cookies to view this gist.<\/p>\n<\/div>\n<\/div>\n

Just make sure it’s placed above the “stop editing” line as shown below:<\/p>\n

Loading gist jennimckinnon\/cd3e732352fb0c68fd9e<\/a><\/p>\n
\n

Please update your cookie preferences<\/a> to enable preference cookies to view this gist.<\/p>\n<\/div>\n<\/div>\n

Now we’re going to set a 301 redirect so that anyone visiting your site will be automatically redirected to your secure site using https<\/em> instead of http<\/em>.<\/p>\n

Edit your .htaccess<\/em> file, or create a new one if it doesn’t already exist. If you already have one, place the following code above everything that’s already there.<\/p>\n

Don’t forget to replace “mysite.com” with your domain and make sure that you enter in the correct server port if yours isn’t 80.<\/p>\n

Loading gist jennimckinnon\/8a6ab1b68d0f9a5674d8<\/a><\/p>\n
\n

Please update your cookie preferences<\/a> to enable preference cookies to view this gist.<\/p>\n<\/div>\n<\/div>\n

Now visit your site to test it out. If https<\/em> appears in your URL with a green padlock beside it you’re all set to go.<\/p>\n

Conclusion<\/h2>\n

Having an SSL certificate for your site is an essential step in\u00a0protecting your site and its visitors, but it’s not the only security measure you should consider using. To further ensure your site is safe for everyone, you could also use a WordPress security plugin, such as Wordfence<\/a> or iThemes<\/a>.<\/p>\n

If you need more pointers on how to use SSL with WordPress for your specific needs, you can check out the\u00a0Administration Over SSL<\/a> page in the WordPress Codex.<\/p>\n

Interested in a free SSL certificate? On November 18, 2014, the Electronic Frontier Foundation (EFF) released an announcement<\/a> that they are working on an opensource project to make SSL certificates free and with the ability to install them in just a few clicks. It will become available in mid 2015.<\/p>\n

There are plugins out there that can help you set up SSL on your site, but do be aware that they may not be up-to-date and compatible with the latest version of WordPress.<\/p>\n

Sometimes it may be okay to use slightly older plugins if many people, including yourself, have had success with them during testing, but your site’s security isn’t something you want to take a chance on.<\/p>\n

If you want even more in depth information on site security, also take a look at our other in-depth posts\u00a0WordPress Security Essentials: Say Goodbye to Hackers<\/a> and\u00a0WordPress Security: The Ultimate Guide<\/a>.<\/p>\n

Image Credits: IETF Trust<\/a>, DigitalOcean, Bruno Pedro<\/a>.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Everyday we give away our personal information on the internet. This is why SSL is so important. Using SSL \u2013 and in turn HTTPS \u2013 to protect your WordPress site and its visitors doesn’t have to be difficult and complicated. In today’s post we look at how to use SSL.<\/p>\n","protected":false},"author":54213,"featured_media":136746,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"blog_reading_time":"","wds_primary_category":0,"wds_primary_tutorials_categories":0,"footnotes":""},"categories":[1117,263],"tags":[10054,10810,10298],"tutorials_categories":[],"class_list":["post-136362","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-multisite","category-tutorials","tag-ssl","tag-wordpress-security","tag-http"],"_links":{"self":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/136362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/users\/54213"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/comments?post=136362"}],"version-history":[{"count":8,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/136362\/revisions"}],"predecessor-version":[{"id":203567,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/136362\/revisions\/203567"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media\/136746"}],"wp:attachment":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media?parent=136362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/categories?post=136362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tags?post=136362"},{"taxonomy":"tutorials_categories","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tutorials_categories?post=136362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}