Switch PHP on site from HTTP to HTTPS, a few things return back to HTTP

[Barsinister88]

I have DRBGuestbook which was written some time ago and the original site that we got the code from no longer exists.  Basically since Google will be marking all sites insecure in June if they don't have SSL I am making my site SSL.  The main pages of the guestbook work fine and the posting and things seem to work but when I log in with administrator it switches from HTTPS back to HTTP after inputting the password.  I am going to attach the entire guestbook as is exists now in hopes that someone can help me make the adjustment that is needed for the pages to stay on HTTPS through the entire processes.  Thank you!

 

guestbook021918.zip

[requinix]

It's a bit of a pain to go through the whole file ourselves...

 

If you're using HTTPS fine and then it sends you to HTTP then there must be a redirect somewhere that explicitly says "http://". So look for that - it might be in PHP code or not.

header("Location: http://" . $website . "/a/b/c");

You could add the 's' in there, but easier is to not have that portion at all. Remove the http:// and the domain name so it's just the URL path:

header("Location: /a/b/c");

[dalecosp]

We use Apache's .htaccess to enforce SSL browsing:

 

RewriteEngine on

#enforce SSL
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For images, scripts, etc, we use relative paths:

 

<img src="//images.oursite.com/path/to/images/foo.jpg" alt='cat'>
<script src="//code.jquery.com/jquery-1.9.1.min.js"></script>

This ensures that we don't have mixed-content blocking going on in the browser, leading to missing images or JS functionality. Edited February 20, 2018 by dalecosp