19 points
Community rank #3103
Chris
SophomoreJust Getting Started
MemberLikes (0)
Hi,
I'm hoping to set up a multisite and some of the sub sites will have their own domain names and some will need SSL (I think!). I will be selling stuff. I will be selling blogs, and classified ads, and amazon stuff.
I'm at a total loss on how to setup SSL, how to select one that will work properly. I'm hearing wildcard ssl due to the multiple subdomains, but, if they are mapped to a specific domain name then that wildcard, will it work?
So, I don't expect thousands of visitors per day, maybe hundreds might be optimistic for the first while.
Should I grab a reseller account?
I know my plans can't be unique! So, what type of hosting plan would you buy?
1213 pointsCommunity rank #41Supreme DeityMind-Blowingly HelpfulLifetime member
Member
(joined October 2011)
Likes (0)
Goodday Chris.
Welcome to WPMUDev. These are some really great questions and I'll answer what I can, but I'll also suggest that we get more insight from @aecnu (Joe) because he runs a hosting/server platform (https://wpmu-hosting.org/) so he can fill in any blanks that I don't fill for you.
First, in regards to hosting: I would definitely not go with a shared hosting account (not even a reseller account that is selling to a shared hosting platform). At a bare minimum, I would go for a VPS (Virtual Private Server). I know of at least two companies that run a VPS system that is slicker than most of them. On many VPS systems, you are allocated a certain amount of resources and that's all you get. The ones that I like (and I have) use a resource allocation tool that will allocate unused resources of others on the server to give a resource hog more resources when needed. When the resources are not needed, then it drops back to the prescribed resources for each account. Back in December of 2011, I launched a website for a client and he sent so much traffic to the server that the VPS allocated 97% of server resources to his website alone. That was nice because more people got served during peak traffic periods. We ended up mirroring the website to a second server, but that's another story altogether.
Now, to the SSL Certificate: For a general multisite application, if you are putting the subsites into subdirectories, then you actually don't need a wildcard SSL Cert. A standard $9 SSL Cert from NameCheap (or any other source) will cover the TLD and all subdirectories. However, if you are putting your subsites into subdomains, you'll definitely need a wildcard SSL Cert because a standard SSL Cert does not cover subdomains.
But, you may be adding a different spin here. If you have people that will register their own domain and that domain is a subsite on your multisite setup, then I believe that they will need to purchase their own SSL Cert. I'm not 100% on that, but when you buy an SSL Cert, part of what they check is the ownership of the domain.
However, I must ask this question. Do you really need an SSL Cert? The number one reason I even have an SSL Cert on any of my domains is that I use one of my domains to serve custom FB pages and FB requires those pages to be hosting on an SSL Cert Domain.
Do you really need an SSL Cert? Where are your visitors actually paying for their purchases? If you are taking them off your website and to PayPal for example, you do not need an SSL Cert for your domain. PayPal becomes the gateway and they have their own SSL Cert. I'm pretty certain that's true for any payment gateway where you take the buyer off of your website. However, you can use PayPal's API and have them pay on your website without ever leaving your website (and other payment gateways offer the same I believe). If you are having them pay at your site and not going to the payment processor's website, then you'll definitely want to get an SSL Cert. However, this should not just be a standard or even a wildcard SSL Cert. When you are talking about payments, you are talking about Credit Card info and other financial and personal information and people will insist on the highest level of SSL that they're accustomed to at other websites. I've seen some of these SSL Certs run into the $1,000's.
My recommendation (unless Joe or someone else differs) is to NOT get the SSL Cert unless you need it for one of the reasons outlined above AND to take all payment processing to the payment processor's website so you don't have to worry about that part of the SSL Cert equation.
I hope this is helpful to you. If you want more information, feel free to post back.
5086 pointsCommunity rank #12Supreme DeityUnpaid StaffLifetime member
Inactive
(joined February 2012)
Likes (0)
Hey Chris,
Welcome to the Community!
I have had my share of hosting / domain mapping / Multisite experiences, but never had to deal with SSL for real. As James pointed out, unless you are accepting payments on your own site, using Paypal express or something for which you wouldn't have to go actually go to paypal.com to pay, SSL isn't needed. But I suppose you want to offer the platform as a service where others can sign-up and setup their store, isn't it?
When it comes to hosting, depending on how fast you have plans to grow, go for VPS. Linode is a very recommended one I hear. I have experiences Hostgator in the past, they are good as well. Dedicated hosting is too expensive, and Shared hosting is too cheap for a project like this. For the record, I have hosted multisite networks with as much as 40 sites that receive 100-500 visits a day on shared hosting with no troubles, but as the traffic increases I know I have to upgrade them.
19 pointsCommunity rank #3103SophomoreJust Getting Started
Member
(joined May 2012)
Likes (0)
Hi James!
Thanks for your reply and info.
What is it about a VPS that you feel is needed? What does a VPS do? Do better? What are the "benefits" to having a multisite hosted on a VPS system?
I'm just assuming I need a cert because somebody suggested I did! Hah! ;-)
I use a classifieds ad system that the payment goes out to PayPal using IPN, upon completing the payment, the user gets directed back to my site and this is where I get a security message:
"although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"
I was told that I probably need a SSL certificate in order to get rid of this message. Hence, my thought that I need a SSL cert! Am I wrong?
All of my sites will do the payment through PayPal and maybe Google Checkout if I decide to add it.
19 pointsCommunity rank #3103SophomoreJust Getting Started
Member
(joined May 2012)
Likes (0)
Hi Arun,
Thanks for replying!
But I suppose you want to offer the platform as a service where others can sign-up and setup their store, isn't it?
well, not really, more that I will be selling classified ads, marketing services, small websites/blogs, design, etc. to a niche market. I don't think I will offer sites that customers can sell stuff on.
I already have three sites that I designed for customers and am hosting for them on their domain on a shared server with dedicated ip. I would like to bring those three sites and a number of classifieds, forums, commerce domains etc. that I own together under one multisite and then offer small sites and services.
Does that make sense? I feel like I'm rambling! Sorry.
91 pointsCommunity rank #593El PresidenteJust Getting Started
Member
(joined June 2012)
Likes (0)
I hope i'm not hijacking the thread
This is interesting what are your thoughts on if I were to allow users to set up there own online shop would the ownership of the domain be an issue as mentioned above. If so is theres a way of providing users with an option to buy an SSL and use it with thier own mapped domain that points to a subdomain in a multisite install.
Am i right in thinking the notice below is because the op is going from a secure paypal page to a no SSL page on the site. If so would a standard SSL on that domain solve the issue.
"although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"
19 pointsCommunity rank #3103SophomoreJust Getting Started
Member
(joined May 2012)
Likes (0)
Hi Arun and David,
Actually I just found out a couple days ago that the Classipress theme I am using - the PayPal IPN has changed recently and they are aware of and trying to fix the warning issue. I think, and I am probably wrong! that when using PayPal IPN you do not need a secure site when the user gets redirected back from PayPal (PayPal Express does?)
So, I apologize for going off on a tangent with this, I was given a goose chase! However, I did discover that if you need SSL certificate you need a dedicated IP and that the vast majority of hosting will only allow one SSL per account.
So, if you have subsites that have their own domain name and you need SSL on each of them, you are out of luck? Unless you can find a hosting package that allows more than one dedicated IP per account? Would that be a VPS or Reseller?
SSL certs can be a pain to setup especially for a newbie. Even when successful you could still run into trouble with wordpress having so many things being brought in from elsewhere. Gravatars for e.g.
An SSL cert requires that you have all content stores only on your domain and this can be a pain with wordpress. It is recommended especially if you are with paypal, that you dont bother and let a third party take care of the security.
5086 pointsCommunity rank #12Supreme DeityUnpaid StaffLifetime member
Inactive
(joined February 2012)
Likes (0)
Hey @david_whitby
That is the easiest way. That way you don't need to have SSL on your website, PayPal takes care of it.
Unless you are a popular brand, I think most users will be comfortable with that. They wouldn't want to give out their credit card info on your site, but rather give them on PayPal which have a (false) sense of security, that's my thought.
Thanks for the compliment and Welcome to the Community!
Responses (11)
Member (joined October 2011) Likes (0)
Goodday Chris.
Welcome to WPMUDev. These are some really great questions and I'll answer what I can, but I'll also suggest that we get more insight from @aecnu (Joe) because he runs a hosting/server platform (https://wpmu-hosting.org/) so he can fill in any blanks that I don't fill for you.
First, in regards to hosting: I would definitely not go with a shared hosting account (not even a reseller account that is selling to a shared hosting platform). At a bare minimum, I would go for a VPS (Virtual Private Server). I know of at least two companies that run a VPS system that is slicker than most of them. On many VPS systems, you are allocated a certain amount of resources and that's all you get. The ones that I like (and I have) use a resource allocation tool that will allocate unused resources of others on the server to give a resource hog more resources when needed. When the resources are not needed, then it drops back to the prescribed resources for each account. Back in December of 2011, I launched a website for a client and he sent so much traffic to the server that the VPS allocated 97% of server resources to his website alone. That was nice because more people got served during peak traffic periods. We ended up mirroring the website to a second server, but that's another story altogether.
Now, to the SSL Certificate: For a general multisite application, if you are putting the subsites into subdirectories, then you actually don't need a wildcard SSL Cert. A standard $9 SSL Cert from NameCheap (or any other source) will cover the TLD and all subdirectories. However, if you are putting your subsites into subdomains, you'll definitely need a wildcard SSL Cert because a standard SSL Cert does not cover subdomains.
But, you may be adding a different spin here. If you have people that will register their own domain and that domain is a subsite on your multisite setup, then I believe that they will need to purchase their own SSL Cert. I'm not 100% on that, but when you buy an SSL Cert, part of what they check is the ownership of the domain.
However, I must ask this question. Do you really need an SSL Cert? The number one reason I even have an SSL Cert on any of my domains is that I use one of my domains to serve custom FB pages and FB requires those pages to be hosting on an SSL Cert Domain.
Do you really need an SSL Cert? Where are your visitors actually paying for their purchases? If you are taking them off your website and to PayPal for example, you do not need an SSL Cert for your domain. PayPal becomes the gateway and they have their own SSL Cert. I'm pretty certain that's true for any payment gateway where you take the buyer off of your website. However, you can use PayPal's API and have them pay on your website without ever leaving your website (and other payment gateways offer the same I believe). If you are having them pay at your site and not going to the payment processor's website, then you'll definitely want to get an SSL Cert. However, this should not just be a standard or even a wildcard SSL Cert. When you are talking about payments, you are talking about Credit Card info and other financial and personal information and people will insist on the highest level of SSL that they're accustomed to at other websites. I've seen some of these SSL Certs run into the $1,000's.
My recommendation (unless Joe or someone else differs) is to NOT get the SSL Cert unless you need it for one of the reasons outlined above AND to take all payment processing to the payment processor's website so you don't have to worry about that part of the SSL Cert equation.
I hope this is helpful to you. If you want more information, feel free to post back.
James Dunn
Athens, GA USA
Inactive (joined February 2012) Likes (0)
Hey Chris,
Welcome to the Community!
I have had my share of hosting / domain mapping / Multisite experiences, but never had to deal with SSL for real. As James pointed out, unless you are accepting payments on your own site, using Paypal express or something for which you wouldn't have to go actually go to paypal.com to pay, SSL isn't needed. But I suppose you want to offer the platform as a service where others can sign-up and setup their store, isn't it?
When it comes to hosting, depending on how fast you have plans to grow, go for VPS. Linode is a very recommended one I hear. I have experiences Hostgator in the past, they are good as well. Dedicated hosting is too expensive, and Shared hosting is too cheap for a project like this. For the record, I have hosted multisite networks with as much as 40 sites that receive 100-500 visits a day on shared hosting with no troubles, but as the traffic increases I know I have to upgrade them.
I will pass this onto Joe for his insight :)
Member (joined May 2012) Likes (0)
Hi James!
Thanks for your reply and info.
What is it about a VPS that you feel is needed? What does a VPS do? Do better? What are the "benefits" to having a multisite hosted on a VPS system?
I'm just assuming I need a cert because somebody suggested I did! Hah! ;-)
I use a classifieds ad system that the payment goes out to PayPal using IPN, upon completing the payment, the user gets directed back to my site and this is where I get a security message:
"although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"
I was told that I probably need a SSL certificate in order to get rid of this message. Hence, my thought that I need a SSL cert! Am I wrong?
All of my sites will do the payment through PayPal and maybe Google Checkout if I decide to add it.
Do I even need a cert?
Member (joined May 2012) Likes (0)
Hi Arun,
Thanks for replying!
well, not really, more that I will be selling classified ads, marketing services, small websites/blogs, design, etc. to a niche market. I don't think I will offer sites that customers can sell stuff on.
I already have three sites that I designed for customers and am hosting for them on their domain on a shared server with dedicated ip. I would like to bring those three sites and a number of classifieds, forums, commerce domains etc. that I own together under one multisite and then offer small sites and services.
Does that make sense? I feel like I'm rambling! Sorry.
Inactive (joined February 2012) Likes (0)
Hey Chris,
In that case, I wouldn't suggest SSL unless your gateway asks for it (like Paypal Express).
Hope the suggestions of others helped as well. What have you decided?
Member (joined June 2012) Likes (0)
I hope i'm not hijacking the thread
This is interesting what are your thoughts on if I were to allow users to set up there own online shop would the ownership of the domain be an issue as mentioned above. If so is theres a way of providing users with an option to buy an SSL and use it with thier own mapped domain that points to a subdomain in a multisite install.
Am i right in thinking the notice below is because the op is going from a secure paypal page to a no SSL page on the site. If so would a standard SSL on that domain solve the issue.
"although this page is encrypted, the information you have entered is to be sent over an unencrypted connection and could easily be read by a third party. Are you sure you want to continue sending this information?"
Member (joined May 2012) Likes (0)
Hi Arun and David,
Actually I just found out a couple days ago that the Classipress theme I am using - the PayPal IPN has changed recently and they are aware of and trying to fix the warning issue. I think, and I am probably wrong! that when using PayPal IPN you do not need a secure site when the user gets redirected back from PayPal (PayPal Express does?)
So, I apologize for going off on a tangent with this, I was given a goose chase! However, I did discover that if you need SSL certificate you need a dedicated IP and that the vast majority of hosting will only allow one SSL per account.
So, if you have subsites that have their own domain name and you need SSL on each of them, you are out of luck? Unless you can find a hosting package that allows more than one dedicated IP per account? Would that be a VPS or Reseller?
Member (joined January 2012) Likes (0)
SSL certs can be a pain to setup especially for a newbie. Even when successful you could still run into trouble with wordpress having so many things being brought in from elsewhere. Gravatars for e.g.
An SSL cert requires that you have all content stores only on your domain and this can be a pain with wordpress. It is recommended especially if you are with paypal, that you dont bother and let a third party take care of the security.
Member (joined November 2011) Likes (0)
If you have a good systems administrator on hand, I REALLY recommend Linode on overall value.
With Linode, you'll get the best performance per dollar I've seen anywhere.
Good luck host hunting!
Member (joined June 2012) Likes (0)
HI
Good info here,
So just to confirm its a good idea to have the user leave the site go to paypal and then be directed back to the site.
Thanks
You guys are awesome
Inactive (joined February 2012) Likes (0)
Hey @david_whitby
That is the easiest way. That way you don't need to have SSL on your website, PayPal takes care of it.
Unless you are a popular brand, I think most users will be comfortable with that. They wouldn't want to give out their credit card info on your site, but rather give them on PayPal which have a (false) sense of security, that's my thought.
Thanks for the compliment and Welcome to the Community!
Become a member