Website security

bruce205 · July 13, 2022, 06:12:57 PM

To whom it may concern, why is this website continually being flagged as unsafe on multiple browsers ?? Is it a matter of cash outlay to update your certificate? It was mentioned a while ago by Gusington or Jarhead I think about getting it updated but nothing has been done.
Don't get me wrong as this is my most visited site (daily) Just kinda concerned is all. Thanks for any replies.

Bruce

bobarossa · July 13, 2022, 07:05:27 PM

My Firefox doesn't flag it as unsafe. Maybe I told it not to bother me about the whole http/https thing.

bruce205 · July 13, 2022, 07:14:48 PM

I should have said my browsers report it as unsecure. Believe it may be a good idea in this day and age to pay attention to security on the internet. Not to say that I'm preaching as I hate that and everyone is free to do as they wish but I wanted to bring it to everyones attention.

Jarhead0331 · July 13, 2022, 07:45:12 PM

I'm not sure why it is being flagged as unsecure on your end. It isn't in my browser. I checked just a couple of weeks ago and our SSL certificate is totally up to date.

Starfury and Gusington are total sluts, so maybe your browser is picking up on their unsafe dating habits and poor personal hygiene?

Seriously though, if you have any idea why that may be the case on your end, let me know and if there is something I can do for my part, and I will.

bruce205 · July 13, 2022, 07:56:27 PM

Hopefully this shows up. Thanks for the replies :)

Grim.Reaper · July 13, 2022, 08:02:29 PM

I had also posted this in the past where people see weird browsing results depending on what specific address they use to access the site...this is because of the security being different between forum and other pages. Here is some info on it from the past post.

Yep, use of HTTPS in the web site address is the cause. If you turn on developer tools for Chrome which allows you to debug, you'll see the following error displayed:

Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure element '<URL>'. This request was automatically upgraded to HTTPS, For more information see <URL> index.php:4 Mixed Content: The page at 'https://www.grogheads.com/forums/index.php?board=5.0'; was loaded over HTTPS, but requested an insecure stylesheet 'http://grogheads.com/forums/Themes/default/css/index.css?fin20';. This request has been blocked; the content must be served over HTTPS.

Basically this means the main forum page is using an HTTPS connection (secure encrypted connection), therefore the other content it calls such as the various style sheets (responsible for formatting the page) must also use an HTTPS connection to be fully secure. As you can see in the above error message, the CSS files (style sheets) are using an HTTP connection, therefore its considered insecure and blocked resulting in the style sheets not loaded making the page appearance look bad. Since a normal user doesn't have control over changing the actual page source code to be HTTPS, only way for you to make it work is to change the main page to HTTP so they all match. I assume the forum software site/pages could be configured in a way to enforce full usage of HTTPS, therefore everything would be encrypted, not requiring the use of HTTP.

With HTTPS (secure-but issues loading content)
https://www.grogheads.com/forums/index.php

Without HTTPS (insecure-but content loads correctly)
http://www.grogheads.com/forums/index.php

Of course there is a downside in not using an HTTPS connection. Basically anything you type will not be encrypted and in theory available for someone to intercept if they knew how and were capable On a forum site, might not be a big deal, but hopefully your not using the same username and password for this site that you use for more sensitive sites such as banking:)

bruce205 · July 13, 2022, 08:06:14 PM

Thanks

Gusington · July 13, 2022, 09:27:56 PM

^ I was going to say since time immemorial (2012) GH has showed up as 'insecure' for me because of the whole HTTP/HTTPS thing. Don't do your banking here.

And my hygiene has...improved.

Sir Slash · July 13, 2022, 09:48:05 PM

At my age this is the only unsecure thing I get to do anymore. I'm here for the D-A-N-G-E-R! ^-^

Gusington · July 14, 2022, 07:42:58 AM

Actual image of Sir Slash.

Sir Slash · July 14, 2022, 09:23:20 AM

I'm the one on the left. O0

Gusington · July 14, 2022, 11:28:27 AM

;D

SirAndrewD · July 14, 2022, 12:51:23 PM

I'll take over security.

Gusington · July 14, 2022, 01:57:23 PM

Such a...photo

GeneralHawk · July 14, 2022, 03:02:56 PM

Thank you for explaining it all. Was wondering why different formats get pulled up...

Quote from: Grim.Reaper on July 13, 2022, 08:02:29 PM
I had also posted this in the past where people see weird browsing results depending on what specific address they use to access the site...this is because of the security being different between forum and other pages. Here is some info on it from the past post.

Yep, use of HTTPS in the web site address is the cause. If you turn on developer tools for Chrome which allows you to debug, you'll see the following error displayed:

Mixed Content: The page at '<URL>' was loaded over HTTPS, but requested an insecure element '<URL>'. This request was automatically upgraded to HTTPS, For more information see <URL> index.php:4 Mixed Content: The page at 'https://www.grogheads.com/forums/index.php?board=5.0'; was loaded over HTTPS, but requested an insecure stylesheet 'http://grogheads.com/forums/Themes/default/css/index.css?fin20';. This request has been blocked; the content must be served over HTTPS.

Basically this means the main forum page is using an HTTPS connection (secure encrypted connection), therefore the other content it calls such as the various style sheets (responsible for formatting the page) must also use an HTTPS connection to be fully secure. As you can see in the above error message, the CSS files (style sheets) are using an HTTP connection, therefore its considered insecure and blocked resulting in the style sheets not loaded making the page appearance look bad. Since a normal user doesn't have control over changing the actual page source code to be HTTPS, only way for you to make it work is to change the main page to HTTP so they all match. I assume the forum software site/pages could be configured in a way to enforce full usage of HTTPS, therefore everything would be encrypted, not requiring the use of HTTP.

With HTTPS (secure-but issues loading content)
https://www.grogheads.com/forums/index.php

Without HTTPS (insecure-but content loads correctly)
http://www.grogheads.com/forums/index.php

Of course there is a downside in not using an HTTPS connection. Basically anything you type will not be encrypted and in theory available for someone to intercept if they knew how and were capable On a forum site, might not be a big deal, but hopefully your not using the same username and password for this site that you use for more sensitive sites such as banking:)