2

It seems google has started indexing the secure url for my site's homepage - this has caused the CSS and JS links to break a la Https - layout broken, but I'm not sure how to fix it, as the answer in that thread didn't explain what needed to be changed, and I wouldn't even know where to start with google

Does anyone know of a solution to either stop google indexing the secure homepage, or what to do to allow the CSS and JS files to have secure urls?

Improve this question
5
  • Put everything behind SSL. blog.fabian-blechschmidt.de/ssl-everywhere-or-hsts
    – Fabian Blechschmidt
    Commented May 21, 2014 at 14:00
  • Are there any cons to putting the whole site behind SSL?
    – eddhall
    Commented May 21, 2014 at 14:07
  • people discussing that this costs more cpu, this is right on old hardware. Beside of this, google might rank https higher(?)
    – Fabian Blechschmidt
    Commented May 21, 2014 at 14:08
  • hmm interesting, unfortunately your blog post is a little out of my depth, do I need to understand all of it in order to implement this?
    – eddhall
    Commented May 21, 2014 at 14:10
  • no, the blogpost is in the beginning about why SSL is important but the main point of the post is to use HSTS, which is a tecnique to avoid the first request to be http (just read the wikipedia article about HSTS). What you just have to do is set your secure and unsecure base_url to https://*
    – Fabian Blechschmidt
    Commented May 21, 2014 at 14:12

2 Answers 2

Reset to default
1

What you just have to do to just serve everything via HTTPS is, to set your secure and unsecure base_url to https://*

Improve this answer
5
  • Hey Fabian, Thanks so much, this has worked, although it has broken a few minor things, one of which is embed codes to youtube videos, of which we have quite a few! - do you know of any way to automatically redirect any http link to the https?
    – eddhall
    Commented May 21, 2014 at 15:13
  • 1
    Instead of using http:// you should use // in your code, this is HTTP standard (or HTML?) and says: please use whatever protocol this site is using, like / for please us the base url. Beside of this, you can just throw a redirect into your htaccess (better htconf) stackoverflow.com/a/4083233/1480397
    – Fabian Blechschmidt
    Commented May 21, 2014 at 15:16
  • Do not forget to mark as this as the accepted answer.
    – SR_Magento
    Commented May 21, 2014 at 17:39
  • Hey again Fabian, unfortunately this doesn't work as a long term solution - we have a 3rd party order/inventory management system and the api won't work with your solution :\
    – eddhall
    Commented May 22, 2014 at 8:41
  • why that?! I hope your API connects via https, if not you send ALL your business data unencrypted through the web!?
    – Fabian Blechschmidt
    Commented May 22, 2014 at 9:06
-1

Add this to your .htaccess page to get Google to un-index your homepage as secure:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule ^$ http://www.your_domain.com/ [R=301,L]

The above will 301 redirect a user or Google that tries to land on your homepage securely to the non-secure version.

It may take Google a few weeks to correct its index, but the code above will fix the insecure mismatches.

Improve this answer
2
  • 2
    This may mistakenly also try to redirect the cart/checkout/admin which should be https and therefore cause a redirect loop.
    – philwinkle
    Commented May 21, 2014 at 17:28
  • It shouldn't, as it matches only the root domain with "^$" in the rewriterule. It will not interfere with other URLs. We use this rewrite all the time for many clients' websites without any issues. It simply only redirects the homepage if it is accessed securely (which Firefox forces by default).
    – Rob Mangiafico
    Commented May 21, 2014 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.