Migrating all sites on Multisite to SSL

Trying to upgrade all sites on this multisite to use SSL and when SSL is forced (via .htaccess), cannot log into the admin side with complaints from Chrome about "This page includes a form with a non-secure "action" attribute.".

  • Predrag Dubajic

    Hi Thomas,

    Hope you're doing well :slight_smile:

    Suggestion by splaquet is a good one to check, if your site is still loading some resources over HTTP it can cause these issues and above plugin might just do the trick.

    Also, do you see any errors in the console when you try to login, something that would tell us where the insecure content is coming from?
    You can open Chrome console by pressing Ctrl + Shift + J (Windows / Linux) or Cmd + Opt + J (Mac), try to login and see if there are any mixed content warnings in there.

    Best regards,
    Predrag

  • Thomas Thixton

    Tried using HTTP / HTTPS Remover: SSL Mixed Content Fix, however, found that it bled over into the RSS feed to Maichimp and the cleaned up URL's broke the MIME since most email readers have yet to support the '//' shorthand which most browsers now support. "SSL Insecure Content Fixer" seems to do a better job, also open source, but giving it a try instead.

    Wishing WPMU had a more wholistic solution for this.

  • Thomas Thixton

    Now it seems that we can't disable "HTTP / HTTPS Remover: SSL Mixed Content Fix" without locking ourselves out of the sub-sites on our multisite. Looking for an alternate plugin for cleaning up mixed-content and now, while the RSS feeds seems cleaner with "SSL Insecure Content Fixer", the sub-site admin login portal complains about insecure content and won't let us log in. Turning HTTP / HTTPS Remover: SSL Mixed Content Fix back on fixed this, but now worried that HTTP / HTTPS Remover: SSL Mixed Content Fix may have permanently written to the database and now we are stuck with it.

  • Predrag Dubajic

    Hi Thomas,

    If I understand correctly the plugin messed up your databases and replaced all HTTP mentions with HTTPS, is that correct?

    Do you have a backup of the DB you can restore to?

    There's also an SQL query that you can use for search and replace if you want to get rid of the changes made by the plugin:

    UPDATE wp_options SET option_value = replace(option_value, 'OLD_VALUE', 'NEW_VALUE') WHERE option_name = 'home' OR option_name = 'siteurl';
    
    UPDATE wp_posts SET guid = replace(guid, 'OLD_VALUE','NEW_VALUE');
    
    UPDATE wp_posts SET post_content = replace(post_content, 'OLD_VALUE', 'NEW_VALUE');
    
    UPDATE wp_postmeta SET meta_value = replace(meta_value,'OLD_VALUE','NEW_VALUE');

    Best regards,
    Predrag

    • Thomas Thixton

      Yes, we have backups to before installing "HTTP / HTTPS Remover: SSL Mixed Content Fix:", but it does seem to do a nice job, save for the RSS feed corruption of URL's to Mailchimp with // links to images that most mail reader do not interpret properly yet.

      And was really hoping to not get into manual edits of the DB to clean up what "HTTP / HTTPS Remover: SSL Mixed Content Fix:" might have changed.

      Was hoping for a third option of something that can restore the https: on the links used within RSS or and option to tell "HTTP / HTTPS Remover: SSL Mixed Content Fix:" not to 'clean' the RSS content.

  • Thomas Thixton

    Examples of // being fed into RSS feed w/ http or https...

    Sample from RSS:
    <guid isPermaLink="false">https://www.nowfindglutenfree.com/?p=7090</guid> <description><![CDATA[<img width="768" height="405" src="//dev.nowfindglutenfree.com/wp-content/uploads/sites/2/2018/05/shutterstock_1036450444-768x405.jpg" class="webfeedsFeaturedVisual wp-post-image" alt="" style="display: block; margin-bottom: 5px; clear:both;max-width: 100%;" srcset="//dev.nowfindglutenfree.com/wp-content/uploads/sites/2/2018/05/shutterstock_1036450444-768x405.jpg 768w, //dev.nowfindglutenfree.com/wp-content/uploads/sites/2/2018/05/shutterstock_1036450444-300x158.jpg 300w, //dev.nowfindglutenfree.com/wp-content/uploads/sites/2/2018/05/shutterstock_1036450444-150x79.jpg 150w, //dev.nowfindglutenfree.com/wp-...

    Sample MIME from Mailchimp as a result. Note the <img below for shutterstock_1036450444-768x405.jpg:

    --_----------=_MCPart_2138553333
    Content-Type: text/plain; charset="utf-8"; format="fixed"
    Content-Transfer-Encoding: quoted-printable

    Delicious Food and No Worries =E2=80=93
    The Way Gluten-Free Living Can Be!
    View this email in your browser (https://us13.campaign-archive.com/?u=3D3b=
    a46ad8d59463dc06d73439f&id=3D4a7ab9ca0a&e=3D)

    ** Using the Product Page to Now Find Foods for a Healthier You! (https://=
    dev.nowfinddairyfree.com/using-the-product-page/?utm_source=3DNFF+Staff&ut=
    m_campaign=3D4a7ab9ca0a-RSS_EMAIL_CAMPAIGN_NowFindDairyFree&utm_medium=3De=
    mail&utm_term=3D0_d9f714d94f-4a7ab9ca0a-)
    ------------------------------------------------------------
    By Now Find App Team on May 02=2C 2018 11:30 am

    The post Using the Product Page to Now Find Foods for a Healthier You! (//=
    dev.nowfinddairyfree.com/using-the-product-page/) appeared first on Now Fi=
    nd Dairy-Free (//dev.nowfinddairyfree.com) .
    Read in browser =C2=BB (https://dev.nowfinddairyfree.com/using-the-product=
    -page/?utm_source=3DNFF+Staff&utm_campaign=3D4a7ab9ca0a-RSS_EMAIL_CAMPAIGN=
    _NowFindDairyFree&utm_medium=3Demail&utm_term=3D0_d9f714d94f-4a7ab9ca0a-=
    )
    ...
    <img width=3D"768" src=3D"//dev.nowfindglutenfree.com/wp-content/uploads/s=
    ites/2/2018/05/shutterstock_1036450444-768x405.jpg" class=3D"webfeedsFeatu=
    redVisual wp-post-image mcRssImage" alt=3D"" style=3D"max-width: 100%; wid=
    th: 100%; padding-bottom: 0; display: inline; vertical-align: bottom; bord=
    er: 0; height: auto; outline: none; text-decoration: none; -ms-interpolati=
    on-mode: bicubic;" srcset=3D"//dev.nowfindglutenfree.com/wp-content/upload=
    s/sites/2/2018/05/shutterstock_1036450444-768x405.jpg 768w=2C //dev.nowfin=
    dglutenfree.com/wp-content/uploads/sites/2/2018/05/shutterstock_1036450444=

  • Thomas Thixton

    Reviewing the DB, it looks like it may have been unaffected by these two new plugins, so not sure a manual cleanup is required.

    However, we do have the persistent problem that the RSS image URL's being too clean for Mailchimp to repackage into an email campaign since most email readers do not understand the new // convention.

    Wondering if there are any RSS plugins that help with grooming/cleaning content before it goes out.

    Or wondering if there are versions of SSL Mixed-Content cleaners that let you opt the RSS feed out of the cleaning process.

Thank NAME, for their help.

Let NAME know exactly why they deserved these points.

Gift a custom amount of points.