M1- How to Properly Enable Full Site HTTPS?

Question

I need advice as I have found mixed suggestions on how to Properly change site to FULL-HTTPS (frontend and backend).

I have set "YES" for both "Use Secured URL's in Frontend and Admin", but the site still loads as http:// with the exception of admin and checkout pages, they are https://.

Now I am thinking, in the Unsecured Section: Should I change base url from http:// to https:// ?

As well, should I also change the following unsecured values to Secured?

{{unsecure_base_url}}

{{unsecure_base_url}}skin/

{{unsecure_base_url}}media/

{{unsecure_base_url}}js/

Finally, how to properly redirect google traffic so that all http://example.com/baseballhat, links redirected to secured version https://example.com/baseballhat, rather than to the secured homepage https://example.com/

Answer 1

Yes, you change the protocol for the unsecure Base URL to https. You do not need to change the other unsecure Base URLs (for Link, Skin, or Media), because it's using a shortcode variable that uses whatever you have configured for Base URL.

Here is how we have it configured:

As for maintaining your page rank on Google:

NGINX - Add the following to your Nginx config.

server {
 listen 80;
 server_name domain.com www.domain.com;
 return 301 https://domain.com$request_uri;
}

Apache - Add the following to your .htaccess file.

<IfModule mod_rewrite.c>
 RewriteEngine On
 RewriteCond %{HTTPS} !=on
 RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
</IfModule>

Note: mod_rewrite must be enabled on the Apache server.