View source for Enabling HTTPS on your site/en

<noinclude><languages /></noinclude>
{{:Security Checklist/TOC/en}}
== What is SSL/TLS? ==
Transport Layer Security (TLS) is the successor to Secure Sockets Layer (SSL) - although many people still refer to it as SSL.
Have you ever noticed the lock icon next to the URL when browsing the internet? That means that all the data you send to that website is being sent encrypted so anyone who may have hacked your network (or similar) and can intercept your requests is unable to view any of the data - they can only see what URLs you are accessing.

== Why Use TLS? ==
Google (and most other search engines) now treat sites using ''https'' with preference<ref>https://webmasters.googleblog.com/2014/08/https-as-ranking-signal.html</ref>. Furthermore many browsers flag any website with a form (such as a login or contact form) that isn't using ''https''<ref>https://www.blog.google/products/chrome/milestone-chrome-security-marking-http-not-secure/</ref>

== How Do I Setup TLS? ==
To set up the certificate, the simplest way is to get your host to do it for you.

The correct certificate to use depends on the security protections required on your website. The least expensive and easiest option is to use [https://letsencrypt.org/ Let's Encrypt] - it's free and, depending on your host, can be often be configured straight from your cPanel or Plesk hosting dashboard.

If you've purchased a Dedicated IP and SSL certificate, ask your host to help and they will get it signed and install it in the correct location for you.

== How Do I Redirect All Traffic to ''https'' ==
=== In Joomla ===
The easiest way to enforce ''https'' traffic is to do it within Joomla. In the Global Configuration there is a ''Force HTTPS'' option that allows you to force HTTPS either in the Administrator only or for the entire site. Prefer the latter.

[[Image:Enable_HTTPS_In_Global_Config-en.png|800px|center|Image Showing the Force HTTPS option in the Joomla 3.x default backend template]]

=== In ''.htaccess'' ===
<syntaxhighlight lang="apache">
RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule .* https://%{HTTP_HOST}%{REQUEST_URI} [QSA,R=301,L]
<IfModule !mod_ssl.c>
Redirect permanent / https://www.yourdomainname.com
</IfModule>
</syntaxhighlight>

==== More Complex ''.htaccess'' Examples ====
To switch from HTTP to HTTPS on any page that has 'abc/def' or 'ghi' in the URL, add something like this:

Code:
<syntaxhighlight lang="apache">RewriteCond %{HTTPS} off
RewriteRule ^(abc/def|ghi)(.*)/?$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]</syntaxhighlight>

...and to switch from HTTPS back to HTTP on any page that has 'home' or 'help' in the URL, do something like this:

Code:
<syntaxhighlight lang="apache">
RewriteCond %{HTTPS} on
RewriteRule ^(home|help)(.*)/?$ http://%{HTTP_HOST}%{REQUEST_URI} [R=301,NC,L]</syntaxhighlight>

If you want to force SSL on a specific folder, insert the code below into an ''.htaccess'' file placed in that specific folder:

Code:
<syntaxhighlight lang="apache">
RewriteEngine On
RewriteCond %{REQUEST_URI} folder
RewriteRule ^(.*)$ https://www.example.com/folder/$1 [R,L]</syntaxhighlight>

Make sure you change the folder reference to the actual folder name. Then be sure to replace ''www.example.com/folder'' with your actual domain name and folder you want to force the SSL on.

<noinclude>
[[Category:Security{{#translation:}}]]
[[Category:Beginners{{#translation:}}]]
</noinclude>