It seems google has started indexing the secure url for my site's homepage - this has caused the CSS and JS links to break a la Https - layout broken, but I'm not sure how to fix it, as the answer in that thread didn't explain what needed to be changed, and I wouldn't even know where to start with google

Does anyone know of a solution to either stop google indexing the secure homepage, or what to do to allow the CSS and JS files to have secure urls?

  • Put everything behind SSL. blog.fabian-blechschmidt.de/ssl-everywhere-or-hsts – Fabian Blechschmidt May 21 '14 at 14:00
  • Are there any cons to putting the whole site behind SSL? – eddhall May 21 '14 at 14:07
  • people discussing that this costs more cpu, this is right on old hardware. Beside of this, google might rank https higher(?) – Fabian Blechschmidt May 21 '14 at 14:08
  • hmm interesting, unfortunately your blog post is a little out of my depth, do I need to understand all of it in order to implement this? – eddhall May 21 '14 at 14:10
  • no, the blogpost is in the beginning about why SSL is important but the main point of the post is to use HSTS, which is a tecnique to avoid the first request to be http (just read the wikipedia article about HSTS). What you just have to do is set your secure and unsecure base_url to https://* – Fabian Blechschmidt May 21 '14 at 14:12

What you just have to do to just serve everything via HTTPS is, to set your secure and unsecure base_url to https://*

  • Hey Fabian, Thanks so much, this has worked, although it has broken a few minor things, one of which is embed codes to youtube videos, of which we have quite a few! - do you know of any way to automatically redirect any http link to the https? – eddhall May 21 '14 at 15:13
  • 1
    Instead of using http:// you should use // in your code, this is HTTP standard (or HTML?) and says: please use whatever protocol this site is using, like / for please us the base url. Beside of this, you can just throw a redirect into your htaccess (better htconf) stackoverflow.com/a/4083233/1480397 – Fabian Blechschmidt May 21 '14 at 15:16
  • Do not forget to mark as this as the accepted answer. – SR_Magento May 21 '14 at 17:39
  • Hey again Fabian, unfortunately this doesn't work as a long term solution - we have a 3rd party order/inventory management system and the api won't work with your solution :\ – eddhall May 22 '14 at 8:41
  • why that?! I hope your API connects via https, if not you send ALL your business data unencrypted through the web!? – Fabian Blechschmidt May 22 '14 at 9:06

Add this to your .htaccess page to get Google to un-index your homepage as secure:

RewriteEngine On
RewriteCond %{HTTPS} on
RewriteRule ^$ http://www.your_domain.com/ [R=301,L]

The above will 301 redirect a user or Google that tries to land on your homepage securely to the non-secure version.

It may take Google a few weeks to correct its index, but the code above will fix the insecure mismatches.

  • 2
    This may mistakenly also try to redirect the cart/checkout/admin which should be https and therefore cause a redirect loop. – philwinkle May 21 '14 at 17:28
  • It shouldn't, as it matches only the root domain with "^$" in the rewriterule. It will not interfere with other URLs. We use this rewrite all the time for many clients' websites without any issues. It simply only redirects the homepage if it is accessed securely (which Firefox forces by default). – Rob Mangiafico May 21 '14 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.