WordPress.com turns on HTTPS encryption for all websites

Re:WordPress.com turns on HTTPS encryption for all websites by RawInfoSec on Friday April 08, 2016 @05:26PM (#11458145)

While this helps *.wordpress.com users or custom domains using the wordpress.com back end, it's going to cause a ruckus with self hosted ones.

Neither WordPress or LetsEncrypt has any way to modify global server setting on any shared hosting environment. Slapping in an SSL certificate doesn't make a site secure, properly configuring the services that use the cert is what makes it secure.

GoDaddy isn't going to let Company Xyz rebuild Apache or configure cyphers server-wide...

In the end, while this is a move in the right direction, I fear it will give false confidence to many web providers that don't have enterprise experience with security fundamentals.

[ Parent | on HN ]

Re:WordPress.com turns on HTTPS encryption for all websites by CM30 on Friday April 08, 2016 @07:24PM (#11458932)

This won't affect self hosted sites, only those on WordPress.com's platform. A lot of the code for that service isn't present in the self hosted script.

So it won't break servers or shared hosts.

[ Parent | on HN ]

Re:WordPress.com turns on HTTPS encryption for all websites by barsxl on Saturday April 09, 2016 @03:36AM (#11460379)

Many of the larger webhosts have free (but not mandatory) SSL support in production, beta, or on their near-term roadmap.

[ Parent | on HN ]