sus.botdocs

Security finding

Pages served over HTTP only, and internal links that still use http://

Security Warning Severity: Medium

Part of the audit HTTPS enforcement. Finding id: security.httpPagesAndLinks.

What it costs you

Requests that start on http:// travel without encryption.

What to do

Change the links to https:// in the template or the content. For a host without HTTPS, install a certificate first.

What it checks

  • Page only works without HTTPS
  • Internal links point to insecure pages

How to fix it

Switch WordPress and its stored links to https

  1. On the Settings General screen, set both WordPress Address (URL) and Site Address (URL) to the https:// address. If they are greyed out, they are set in wp-config.php.
  2. Links typed into posts keep the old scheme. Back up the database, then replace them with WP-CLI. Run it with --dry-run first to see the report: wp search-replace 'http://www.example.com' 'https://www.example.com' --skip-columns=guid (use your own host).
  3. Menus and theme files with a full http:// address have to be edited by hand.

How to check: Recrawl the site: no internal link starts with http://.

Give the host HTTPS

  1. Install a certificate on the host of [group key].
  2. Then redirect HTTP to HTTPS. security.httpsEnforcement gives the redirect for your server.

How to check: curl -sI [group key] | head -n 5 (expect 301 to the https:// address)

Use https:// in every internal link

  1. Look at the pages listed as evidence. A link that repeats on every page sits in a template, menu or footer; fix it there once.
  2. Write internal links without scheme and host (/contact) or with https://.

How to check: Recrawl: no internal link starts with http://.