Force HTTPS
Sat, 2016-09-10 16:34
I've noticed that you use Let's Encrypt but the whole site is available via HTTP and search engines list HTTP version. I've found about HTTPS version by manually typing it. I suggest forcing users to use HTTPS as HTTP is horribly insecure.
Here's the .htaccess for Apache:
RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
I would also like to see HTTPS used on the Hedgewars web site. Web browsers indicate much more prominently now when a web page is accessed unsecurely with HTTP. When I log into the Hedgewars web site, Firefox shows me this message:
"The connection is not secure. Logins entered here could be compromised."
I agree.
Hi, I am a Hedgewars developer.