Hi. I have a Wordpress built site hosted through Bluehost, and I have my SSL through Comodo. This website is an author site, not collecting money or sensitive information other than email addresses at the moment (any fund transfers go through either the Square Store or Paypal), but I wanted the certificate just in case I decide to sell directly later on, and to bump my SEO. Bluehost tells me that my certificate is working just fine, but when I visit the site using Chrome, I get the gold padlock instead of a green one. And another author who was visiting my site (also using Chrome) said he got a warning from Sitelock (who also has some security on my site through Bluehost, though not their SSL) that my domain’s “SSL not supported”. It was after this that I got in touch with Bluehost, who says my SSL is working okay.
I looked up Chrome’s color coding of the yellow/gold padlock, and Chrome says it could be any number of things, from the person viewing the site’s not having their cache cleared out, to third party code (I’m assuming plugins, etc?) that the site could have that weren’t produced or are running on a secure platform.
I’m really new to web building and only been self-hosted about a month. If someone out there could help ease my mind about this, I’d be grateful!
[b]Your connection to the site is encrypted, but Google Chrome has detected mixed content on the page.[/b] Be careful if you're entering information on this page. Mixed content can provide a loophole for someone to manipulate the page. This content could be third- party images or ads embedded on the page.
Thank you for responding, and so quickly! How do I make sure my images have https links? I upload them to the media section of my site. Sorry if these questions seem juvenile, but I am still learning.
It seems as if all my images do, indeed, all have the https tag. But I didn’t look at every single one of them, as I may already have a couple hundred or more up. But I did a sampling of several scattered throughout, even down to the very first ones I uploaded.
When I clicked on your support article, I tested my site using the page icon (my browser didn’t show the padlock), and the answer was given that the site hasn’t supplied a certificate to the browser. Do I need to take a copy of my certificate’s code and place it somewhere in my site?
In WorPress’s HTML-editor (not Visual Editor), make sure all image links begin with
<img src="https://
or just (“protocol-relative”)
<img src="//
Most of your “insecure” images are in the dark box at the bottom, and in the dark box to the right (Pinterest).
In Chrome, you can press Ctrl+Shift+I, and then click on the yellow triangle with an exclamation mark, to see insecure content. There is content from media-cache-ak0.pinimg.com, which is insecure.
Thank you for your help. I’ve removed all widgets, even though containing links without an https in them, and used the shortcut Control Shift I as you suggested. The only things I can see with a yellow exclamation point are some font codes associated with my theme, but those codes are also crossed off. But I’m still showing not 100% secure.
Ah-ha! I have several on there now to find out where! But can you tell me what it means in the screenshot when it says website not verified? I’ve verified through Alexa, Bing, and Google.
Thank you very much for your help! I figured out what the problem was! Even though all my images in the “media” section changed over from http to https when I upgraded for the SSL, the locations at which the images had been previously inserted did not. Now, I’ve fixed all the pages except my blog post page. I started on that one too but I’ve got 7 pages of posts to go through and correct, and it’s easy way late in my neck of the woods. But I really appreciate your help! At least I didn’t have to start all over from scratch!
If you want to get rid of the “obsolete cryptography” (“gammal kryptografi” in my image), and instead get “modern cryptography” in Chrome, you should, as I suggested in my first post, make TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xC02F) the prefered cipher suite. Your server configuration prefers ciphers with 256-bit key, but actually AES_128_GCM is more secure than AES_256_CBC. And AES_256_GCM is currently only supported by IE on Windows 7+.
Want do do more? Add an HSTS-header with a long duration (180+ days) and a preload-token. Then you can submit your site here, to be included in Google’s preload-list.
Ok you went way beyond my knowledge with that last post! I saw how you had mentioned a cipher in that first post, and had I been unable to figure anything out with my simpler stuff, I would have asked again. But I think you’re talking drugs that may be way above my head as far as programming and writing code!
See, you may as well be speaking Greek to me, as far add I can understand. Not to say I can’t our won’t learn it, but it’s going to take me some time!
I’m now in the process of going through each and every blog post I’ve put up over the last six months, replacing the images. Some, I’ve discovered, were lost through the migration, I assume, but I can replace them. All my “regular pages” are now showing green!
There are wordpress plugins which force rewrite to https. Or you can use a .htaccess. Saves you having to go through possibly hundreds of images and links.
