FORUM CHANGE: HTTPS Secure only access

[EEVblog]

Shortly we'll be changing the forum to force everyone to use a secure https connection.
I get far too many people complaining about the lack of security on the forum (even though they have the option to use https), and I think it's prudent that we enable all connection to be secure.
I realise there are some who needed/wanted an unsecure http access, but I think that doesn't outweigh the importance of security for all by default.

So you may have to log out and back in or something, I'm not sure.

If there are any issues please let us know.

Thanks

[gnif]

It's been done

Nobody should need to re-login.

[bitseeker]

I've been using the secure connection since it became optionally available. Works great. Still working.

[Brumby]

I've been using the secure connection since it became optionally available. Works great. Still working.

Same here.

Just checked it.  Previously, I could switch between http and https and the URLs would continue as whichever one I had entered.  Now it reverts to https straight away.

As above, I haven't had any problems.

[TheDefpom]

Secure connections should be transparent if the server is correctly configured, using htaccess redirects etc.

I’ve not had any issues when swapping over to https in any of my sites, so expect the forum to be fine too as long as the server is automatically redirecting correctly.

[Towger]

The forum is no longer working with Tapatalk.  There are no error messages being returned, just the wait icon spinning.
It may require the url registered with Tapatalk changed to start with https://

How secure is TLS 1.2 anyway? 

[ChunkyPastaSauce]

I've been using the secure connection since it became optionally available. Works great. Still working.

Same here.

Just checked it.  Previously, I could switch between http and https and the URLs would continue as whichever one I had entered.  Now it reverts to https straight away.

Since related, https://www.eff.org/https-everywhere
Automatically forces https connections if possible

[EEVblog]

The forum is no longer working with Tapatalk.  There are no error messages being returned, just the wait icon spinning.
It may require the url registered with Tapatalk changed to start with https://

Try now.

[EEVblog]

The forum is no longer working with Tapatalk.  There are no error messages being returned, just the wait icon spinning.
It may require the url registered with Tapatalk changed to start with https://

Try now.

Posting from tapatalk

Sent from my HMA-L29 using Tapatalk

[Towger]

Tapatalk is working again. Restarted phone as well, but not sure that was needed.

[JustMeHere]

Hey Dave, I don't see the HSTS header.  It might be a good idea to turn that on.  It makes the browser "know" it should use HTTPS.  A browser which has been to your site before will automatically use HTTPS and the redirect is not used.  The redirect is still needed, but this stops bookmarks from having the wrong mode saved.

You should have a header like the one below:

strict-transport-security: max-age=31536000;includeSubDomain

Here's some more detail:
https://www.globalsign.com/en/blog/what-is-hsts-and-how-do-i-use-it/

This is important if you take online payments.  It should also help you score a bit higher on SEO.