Enable HSTS and make sure everything is HTTPS

[phenomlab]

@hari HSTS will have no bearing on redirects, but it of course will require https to work correctly. You can go ahead and enable that.

[Hari]

@phenomlab my website is not loading please help

is there any way to at least disable it temporarily?

[Hari]

@hari looks like i need to download the certificate from Cloudflare and apply it to my root?

[phenomlab]

@hari You can disable it at the CF level. That should be enough ?

[Hari]

@phenomlab i’m bit confused site did not work for 5min due to no proper certificate.

to prevent it from happening shall i apply CF SSL certificate to my server?

ok, if something happens i will try disabling SSL at CF level

now reading this https://support.cloudways.com/en/articles/5130554-how-to-configure-cloudflare-origin-certificate

[Hari]

This post is deleted!

[Hari]

@hari i’m configuring the origin server certificate hope that will not cause conflicts?

ok, we will look it tomorrow. good night

[phenomlab]

@hari enabling HSTS should not be this complex. I’m not sure I understand the need for the origin certificate from CF as this should still work even with a trusted and verified cert on the destination and the communication mode for SSL set to strict.

You can actually enable HSTS and SSL stapling at server level rather than CF.

[Hari]

@phenomlab Right now i am not facing any issues and everything is working perfectly

i want to summarise all my settings

CF settings
SSL is set to full strict
HSTS is enabled
Automatic HTTPS Rewrites CF setting is ON

disabled page rules for https redirect (earlier i used to use)

---

Server-side let’s encrypt is enabled
HTTP to HTTPS prediction is off

---

i want to keep the settings like this since everything is working at the DNS level.

if you suggest using HSTS and SSL from the server-side i will switch to it.

the only problem with flarum www redirection

https://domain.com/ask

shall i define something at subdirectory ht. access for this? or something needs to be done at domain ht access?

[phenomlab]

@hari said in Enable HSTS and make sure everything is HTTPS:

shall i define something at subdirectory ht. access for this? or something needs to be done at domain ht access?

This makes the most sense to me as the redirect can be handled at the subdirectory level. HSTS should also work at the CF level without issue. What error do you get if you enable it ?

[Hari]

@phenomlab No error, it just stuck without www. It should supposed to get redirected to www.domain/ask

This only happening with flarum all other wordpress subdirectories are getting redirected without any issue.

[phenomlab]

@hari Does it work if you set a redirect using rules at CF ?

[Hari]

@phenomlab Yes, if I set a page rule it used to work.

Now shall I set a page rule for www at cloud flare (I don’t want to do it)

I am guessing a www. Redirection at ask folder ht acess would resolve the issue.

[phenomlab]

@hari said in Enable HSTS and make sure everything is HTTPS:

I am guessing a www. Redirection at ask folder ht acess would resolve the issue.

It should, yes. Did you create one previously, and it was ignored ?

[Hari]

@phenomlab No, erlier I used to manage it using CF page rule (all in one rule https and www.) . Now as we switch to HSTS and there is a setting at CF as make sure every page is https it is taking care of http to https redirection so turned of page rules.

Could you suggest me the ht access rule for ask folder only

I have posted my ask folder ht access in my first post of this discussion

[phenomlab]

@hari So to confirm, you want all requests to this URL to be converted to https://www.domain.com ?

[Hari]

@phenomlab all WordPress installations for domain or subdirectory is properly getting redirected to www. so i don’t want to add any rules in main ht access

i want all requests to “ask” folder to be converted to www. https://www.domain.com/ask

only flarum is not doing www. redirection

if writing a global rule is the right approach i will try that

[phenomlab]

@hari You should leverage the .htaccess inside the Flarum root directory and not touch anything else. If you set the forward here, it should work as planned.

Let me know if you need any help.

[Hari]

@phenomlab yes i want you to suggest/modify this for me

RewriteCond %{HTTP_HOST} ^yourdomain.com/ask [NC]
RewriteRule ^(.*)$ http://www.yourdomain.com/ask/$1 [L,R=301]

if i use this line in the subdirectory (flarum) it will redirect to to http?

could you suggest me a line which only modify non www to www and doent touch the https or http thing since DNS is taking care of it.

[phenomlab]

@hari said in Enable HSTS and make sure everything is HTTPS:

RewriteRule ^(.*)$ http://www.yourdomain.com/ask/$1 [L,R=301]

Before we do that, shouldn’t

RewriteRule ^(.*)$ http://www.yourdomain.com/ask/$1 [L,R=301]

Actually be

RewriteRule ^(.*)$ https://www.yourdomain.com/ask/$1 [L,R=301]

?