While preparing the newsletter for May, I thought I would place a quick summary here for those that are interested.

At the beginning of May 2017, I am around 75% of the way through moving everyone from their former hosting to the new hosting. For most people the move required little more than a change to where they were picking up email from. For those using 3rd party email services, or not using mail associated with their domain name, they did not need to do anything.

Some Goodies for you

For many people that find the idea of editing a website to be a daunting prospect they are not generally interested in looking any deeper into the systems that are available through the hosting. Things such as email set up, out of office messaging, forwarders etc. For this reason I have set up Control Panel users for the new system on the basis of whether they were accessing their control panels before the move or not. If you were not using it, I have not bothered to ask. If you are a “power user” then I have set you up on the new system. Anyone wishing to have access to their hosting control panels can contact me and request to be added. I will need from you your contact details including address and telephone number. These are used in the form to set up the control panel user.

In general it allows you to control the following:

Email accounts including password change, supervisor access to accounts, forwarding, out of office messages, setting up new accounts, deleting old accounts.
Setting up Security Certificates, access to DNS entries
Ability to block your hosting to certain countries
Adding or changing sub-domains or domains
Database access and manipulation
Task scheduling
Backup of whole of account including email as well as the website
PHP configuration
FTP access to the hosting
One Click installs for a variety of web based applications.

https://……

One of the significant free additional services available to you in the new hosting is a security certificate which allows you to run your website over an encrypted connection. This uses the same technology that banks use. It means nobody between you and the server can capture what you are doing online. This mainly applies to things you place in forms like usernames and passwords.

I have looked into this area with some trepidation, because just turning it on is not sufficient. You need to add the certificate, then mandate all accesses to the hosting are using https:// (through the control panel). Once these are done there are some changes to the website as well under the General settings. Once you get this far you can access the website, login, fill in forms etc over an https:// (secure) link.

But, and there is always a but, the site was not built at a location that started with https://, it was built at a location starting with http:// this means that image files in particular that are served from the website to the user are passed over unencrypted. I have experimented with a few sites over the past 6 weeks, and while it is possible to get the critical aspects of your site running over https:// any URLs served by the website back to you, such as images in pages are over http://

Does it matter?

No, in short for the types of sites we have it does not matter. The critical things like entering information into forms are covered, so there is definitely a benefit to turning it on. Recent changes to most common browsers over the past 3 months also flag that a page is not secure, so people are becoming more aware of it.

I want all https://….

This question has inevitably come up. Reading about websites that have the same issue, it is quite tedious to change all of the http:// URLs in the website to https:// the obvious place to do this is in the database. But if you are not used to poking around in a database, you are in danger of breaking something.

An easier way to do this…..

I have not fully tested this, but in theory it should work. I use a premium plugin called updraftplus. It is on all of the websites. The version you have allows you to do a lot more things than in the free version. One of which is to move the site to a different location.

The way this works is the plugin goes through the database and rewrites all of the URLs used in the site’s database to a new value. For example moving a site from http://mysite.com to https://mysite.com/testlocation/ would force the plugin to rewrite all of the database resetting the links to https://mysite.com/testlocation/… Because it has forced this change, you can back up the site again, and restore it back to https://mysite.com overwriting the original site. In theory, this should force the plugin to rewrite the database again substituting the new URL to https://mysite.com.

All that should remain is a check for any hardcoded links within the website, typically these might be buried in footers and headers if they were manually entered. Once these are manually changed, the site should now be 100% secure.

I will try to take those steps in the next 6 weeks and report back. So far the results look encouraging.

But my site is not running over https://

If after the move your site is not running over https:// and you want security turned on, then let me know. I can turn on the certificate, make some elementary changes to the wordpress installation and mandate all accesses to the hosting use https:// That gets you most of the way there. So just contact me and ask.

The only sites I can not get this to work on, are sites that do not use the DNS servers of the new hosting company. This will be the situation if I either do not have control over your domain name, for example it is being managed by someone else.