Broken SSL on forum pages

[vgchat]

Hello there, on the forums there are plenty of areas where SSL is broken (such as showthread pages & forumdisplay (not forum home page but rather where the threadlists are). Here's a breakdown of why that is.

https://www.whynopadlock.com/results...0-cc229153c23c

Just browse on down to Mixed Content - Errors

A quick fix is to insert this into vbulletin's headinclude template for your style.

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

The HTTP Content-Security-Policy (CSP) upgrade-insecure-requests directive instructs user agents to treat all of a site's insecure URLs (those served over HTTP) as though they have been replaced with secure URLs (those served over HTTPS). This directive is intended for web sites with large numbers of insecure legacy URLs that need to be rewritten.

The upgrade-insecure-requests directive will not ensure that users visiting your site via links on third-party sites will be upgraded to HTTPS for the top-level navigation and thus does not replace the Strict-Transport-Security (HSTS) header, which should still be set with an appropriate max-age to ensure that users are not subject to SSL stripping attacks.

[ZG Support 1]

The forums are very old and we are planning to give them a major overhaul which should also address this.

[drcoolj]

The forums are very old and we are planning to give them a major overhaul which should also address this.

vbulletin 5 is finally mature and should be an easy upgrade https://www.vbulletin.com/en/upgrade/

(Current Version 5.4.2)

https://forum.vbulletin.com/forum/vb...-now-available