We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 8168
    • 1,118 Posts
    Hi chaps,

    How can I configure MODx to work on https rather than http by default?

    Cheers

    dubbs
      • 1343 ☆ A M B ☆
      • 2,213 Posts
      You would simply redirect traffic to the secure version of the site, for example the htaccess:

      RewriteEngine On
      RewriteCond %{HTTPS} !=on
      RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R,L]
      


      Beyond that you shouldn't need to do anything special.
        Patrick | Server Wrangler
        About Me: Website | Tweets |  MODX Hosting
        • 8168
        • 1,118 Posts
        OK thanks AMDbuilder - there is no setting in MODx anymore for the base url then?
          • 1343 ☆ A M B ☆
          • 2,213 Posts
          Yes, there is a setting (server_protocol) which will update the links. It doesn't prevent accessing the website via http, which the .htaccess code above resolves.
            Patrick | Server Wrangler
            About Me: Website | Tweets |  MODX Hosting
            • 3749
            • 24,544 Posts
            Does running everything in https have much effect on page loads?

            Is there an easy way to make just the Manager Login page https?
              Did I help you? Buy me a beer
              Get my Book: MODX:The Official Guide
              MODX info for everyone: http://bobsguides.com/modx.html
              My MODX Extras
              Bob's Guides is now hosted at A2 MODX Hosting
              • 1343 ☆ A M B ☆
              • 2,213 Posts
              There is some overhead with https connections, however with spdy and ocsp stapling that overhead can be reduced. In either case you might be talking 20-120ms added load (depending on your SSL Certificate).


              Yes, you can put that .htaccess code in the manager folder to force it.
                Patrick | Server Wrangler
                About Me: Website | Tweets |  MODX Hosting
                • 8168
                • 1,118 Posts
                Quote from: AMDbuilder at Sep 01, 2014, 02:44 PM
                Yes, there is a setting (server_protocol) which will update the links. It doesn't prevent accessing the website via http, which the .htaccess code above resolves.

                Thanks - just changed this - what does it actually do? Server engineer had put in the .htaccess code to redirect to https from http but it was creating an infinite loop back to http by MODx apparently - will now that I have changed server_protocol to https this be sorted?
                  • 1343 ☆ A M B ☆
                  • 2,213 Posts
                  I suspect that setting toggles the default link output in MODX to prefer https over http. In regards to the .htaccess code and rewrite loop if you are forcing the domain using the included .htaccess code (below), you will need to modify it to reference the secure site as well.

                  RewriteCond %{HTTP_HOST} .
                  RewriteCond %{HTTP_HOST} !^www\.example\.com [NC]
                  RewriteRule (.*) http://www.example.com/$1 [R=301,L]
                  


                  Would need the last line changed to become:

                  RewriteRule (.*) https://www.example.com/$1 [R=301,L]
                  


                  Note the https instead of http in the first example. My earlier .htaccess code just forces all traffic to https://www.example.com, you need to make sure your other code expects the https://www.example.com domain name to be used. Otherwise in the above example one block would be forcing https and the other forcing http, thus creating a loop.
                    Patrick | Server Wrangler
                    About Me: Website | Tweets |  MODX Hosting