Add guide for enabling HTTPS on different platforms#29
Merged
Conversation
Added comprehensive guide for enabling HTTPS on various hosting platforms including shared hosting, WordPress, Cloudflare, VPS, and others. Included step-by-step instructions and important post-activation checks. Berikut adalah langkah-langkah **tambahan dan lanjutan** yang perlu anda lakukan selepas SSL berjaya diaktifkan untuk memastikan laman web `www.sazwan.fairbase.com` benar-benar selamat, optimum, dan tiada ralat: ### 1. Selesaikan Masalah "Mixed Content" (Penting) Walaupun SSL sudah aktif, laman web mungkin masih menunjukkan amaran⚠️ "Not Secure" jika ada gambar, CSS, atau skrip yang masih dimuatkan melalui `http://`. - **Cara Semak:** Buka laman web → Tekan `F12` → Klik tab **Console**. Cari ralat *Mixed Content*. - **Penyelesaian WordPress:** Pasang plugin **Better Search Replace**. Cari `http://www.sazwan.fairbase.com` dan gantikan dengan `https://www.sazwan.fairbase.com` dalam seluruh pangkalan data (backup dahulu!). - **Penyelesaian Manual:** Periksa kod tema atau widget yang menggunakan pautan luar (external links) yang tidak menyokong HTTPS. ### 2. Kemas Kini Google Search Console & Analytics Google menganggap `http://` dan `https://` sebagai dua entiti berbeza. - Log masuk ke **Google Search Console**. - Tambah properti baharu: `https://www.sazwan.fairbase.com`. - Hantar semula **Sitemap.xml** versi HTTPS. - Kemas kini tetapan **Google Analytics 4 (GA4)** supaya URL lalai ditukar kepada HTTPS agar data pelawat tidak terpecah. ### 3. Aktifkan HSTS (HTTP Strict Transport Security) HSTS memaksa pelayar web untuk *sentiasa* menggunakan HTTPS dan mengelakkan serangan *downgrade*. - **Di cPanel:** Beberapa hosting menyediakan butang "Enable HSTS" di halaman SSL/TLS Status. - **Melalui .htaccess (Jika tiada di cPanel):** Tambah baris ini *di bawah* kod redirect HTTPS tadi: ```apache Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" ``` >⚠️ **Amaran:** Pastikan SSL berfungsi 100% tanpa ralat sebelum mengaktifkan HSTS. Jika SSL mati semasa HSTS aktif, pelawat tidak akan boleh mengakses laman langsung selama tempoh `max-age`. ### 4. Semak Sijil Subdomain & Wildcard Anda menyebut `www.sazwan.fairbase.com`. Pastikan sijil juga meliputi domain utama tanpa www: - Di **SSL/TLS Status**, pastikan kedua-dua `sazwan.fairbase.com` DAN `www.sazwan.fairbase.com` mempunyai padlock hijau. - Jika hanya satu yang hijau, tandakan kedua-duanya dan klik **Run AutoSSL** semula. ### 5. Tetapkan Auto-Renewal & Pemantauan Sijil Let's Encrypt/AutoSSL biasanya sah selama **90 hari**. - **Semak Auto-Renewal:** Di cPanel → SSL/TLS Status, pastikan domain tersebut **TIDAK** ditandakan sebagai "Excluded from AutoSSL". - **Uji Renewal Secara Manual:** Klik "Run AutoSSL" sebulan sekali untuk memastikan proses pembaharuan berjalan lancar. - **Pemantauan Percuma:** Daftar di [UptimeRobot](https://uptimerobot.com/) atau [SSL Mate](https://sslmate.com/) untuk menerima e-mel amaran 30 hari sebelum sijil tamat tempoh. ### 6. Uji Gred Keselamatan SSL Jangan anggap SSL aktif = SSL selamat. Konfigurasi lemah boleh mendapat gred C atau F. - Layari **[SSL Labs Test](https://www.ssllabs.com/ssltest/)**. - Masukkan `www.sazwan.fairbase.com`. - Sasarkan gred **A** atau **A+**. Jika dapat B atau lebih rendah, laporan itu akan memberitahu tepat apa yang perlu dibaiki (contoh: TLS 1.0/1.1 perlu dilumpuhkan, cipher lemah, dll). --- ### Senarai Semak Ringkas Pasca-Aktivasi | Tugas | Status | | :--- | :--- | | Redirect HTTP → HTTPS berfungsi | ☐ | | Tiada Mixed Content di Console | ☐ | | Kedua-dua www & non-www mempunyai SSL | ☐ | | Google Search Console dikemas kini | ☐ | | HSTS diaktifkan (pilihan tetapi disyorkan) | ☐ | | Auto-Renewal tidak di-exclude | ☐ | | Gred SSL Labs ≥ A | ☐ | Adakah anda mahu saya bantu dengan mana-mana langkah spesifik di atas? Contohnya, saya boleh berikan arahan terperinci untuk **menggantikan pautan Mixed Content dalam WordPress** atau **konfigurasi HSTS yang selamat** untuk server anda. Here is a comprehensive guide to enabling HTTPS across the most common web platforms. Since you previously asked in Malay, this guide is provided in **Bahasa Melayu** for consistency, covering platforms beyond cPanel. ### 1. WordPress (Self-Hosted) *Selepas SSL dipasang di server/hosting:* 1. Pasang plugin **Really Simple SSL** atau **WP Force SSL**. 2. Aktifkan plugin → Klik **"Go ahead, activate SSL"**. 3. Plugin akan menukar URL laman secara automatik dan menyelesaikan *mixed content*. 4. **Manual (tanpa plugin):** Pergi ke **Tetapan > Umum** → Tukar "Alamat WordPress" dan "Alamat Laman" daripada `http://` kepada `https://`. 5. Tambah kod ini dalam `wp-config.php` untuk memaksa SSL di dashboard: ```php define('FORCE_SSL_ADMIN', true); ``` --- ### 2. Blogger / Blogspot *Blogger menyediakan SSL percuma secara terbina dalam:* 1. Log masuk ke **Blogger Dashboard**. 2. Pergi ke **Tetapan (Settings)** → Bahagian **HTTPS**. 3. Hidupkan **"Kesediaan HTTPS"** (HTTPS Availability). 4. Tunggu status bertukar kepada "Sijil sedang diproses" → Kemudian "Aktif". 5. Hidupkan **"Pengalihan HTTPS"** (HTTPS Redirect) untuk memaksa semua trafik ke HTTPS. 6.⚠️ Jika status kekal "Tidak Tersedia": Buang semua widget/gambar yang menggunakan `http://` luaran, kemudian cuba lagi selepas 24 jam. --- ### 3. VPS / Server Sendiri (Ubuntu/Debian + Nginx/Apache) *Gunakan Certbot (Let's Encrypt) – percuma & auto-renew:* **Nginx:** ```bash sudo apt update && sudo apt install certbot python3-certbot-nginx sudo certbot --nginx -d domain.com -d www.domain.com # Uji auto-renewal: sudo certbot renew --dry-run ``` **Apache:** ```bash sudo apt update && sudo apt install certbot python3-certbot-apache sudo certbot --apache -d domain.com -d www.domain.com sudo certbot renew --dry-run ``` **Docker / Reverse Proxy (Caddy):** Caddy mengaktifkan HTTPS **secara automatik** tanpa sebarang konfigurasi tambahan: ```caddyfile www.sazwan.fairbase.com { reverse_proxy localhost:8080 } ``` --- ### 4. Cloudflare (CDN / Proxy) *Sesuai jika domain sudah di-proxy melalui Cloudflare:* 1. Login ke **Cloudflare Dashboard** → Pilih domain. 2. Pergi ke **SSL/TLS** → **Overview**. 3. Tetapkan mod enkripsi: - **Full (Strict)** ← *Disyorkan* (server asal mesti ada SSL sah) - **Full** ← Server asal ada SSL tapi self-signed - ❌ **Flexible** ← *Elakkan* (boleh menyebabkan redirect loop) 4. Pergi ke **Edge Certificates** → Aktifkan: - ✅ Always Use HTTPS - ✅ Automatic HTTPS Rewrites - ✅ HSTS (pilihan, selepas yakin SSL stabil) --- ### 5. Platform E-Commerce & Website Builder | Platform | Cara Aktifkan HTTPS | Nota Penting | | :--- | :--- | :--- | | **Shopify** | Automatik. Pergi ke **Online Store > Domains** → Klik "Activate SSL". | Ambil masa 48 jam selepas domain disambungkan. | | **Wix** | Automatik untuk semua pelan berbayar. Tiada tetapan manual. | Domain custom mesti disambungkan dahulu. | | **Squarespace** | Automatik. Semua laman dilindungi SSL secara lalai. | Sijil dijana semula setiap 90 hari secara automatik. | | **Laravel Forge** | Satu klik: Pilih site → **SSL** → **Obtain Certificate** (Let's Encrypt). | Auto-renewal dikonfigurasi secara automatik. | | **Vercel / Netlify** | Automatik. Setiap deployment mendapat SSL percuma. | Domain custom: Tambah di dashboard → SSL dijana automatik. | --- ### 6. Localhost / Development Environment *Untuk tujuan pembangunan sahaja, bukan produksi:* ```bash # Menggunakan mkcert (disyorkan – dipercayai oleh pelayar tempatan) brew install mkcert # macOS mkcert -install mkcert localhost 127.0.0.1 ::1 # Atau menggunakan Caddy (auto-SSL untuk localhost) caddy file-server --listen :443 ``` --- ###⚠️ Senarai Semak Universal (Semua Platform) Tidak kira platform apa pun, sentiasa lakukan perkara ini selepas mengaktifkan HTTPS: 1. ✅ **Uji redirect:** Taip `http://domain.com` → Mesti bertukar ke `https://` 2. ✅ **Semak Mixed Content:** F12 → Console → Tiada amaran kuning/merah 3. ✅ **Verifikasi sijil:** Klik 🔒 di address bar → Sijil sah & belum tamat tempoh 4. ✅ **Uji gred keselamatan:** [ssllabs.com/ssltest](https://www.ssllabs.com/ssltest/) → Sasarkan **A** atau **A+** 5. ✅ **Kemas kini Search Console:** Tambah properti HTTPS baharu + hantar sitemap semula > 💡 **Petua:** Jika anda memberitahu saya platform spesifik yang anda gunakan, saya boleh berikan arahan yang lebih terperinci dan tepat untuk situasi anda.
Sazwanismail
added
Win
|
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
codeant-ai
Bot
added
size:L
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a guide on enabling HTTPS (SSL) across different hosting platforms. Feedback includes renaming the file to include a proper .md extension, cleaning up duplicate concatenated drafts and conversational filler within the document, and ensuring that package installation commands are preceded by a package index update.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
User description
Added comprehensive guide for enabling HTTPS on various hosting platforms including shared hosting, WordPress, Cloudflare, VPS, and others. Included step-by-step instructions and important post-activation checks. Berikut adalah langkah-langkah tambahan dan lanjutan yang perlu anda lakukan selepas SSL berjaya diaktifkan untuk memastikan laman web
www.sazwan.fairbase.combenar-benar selamat, optimum, dan tiada ralat:1. Selesaikan Masalah "Mixed Content" (Penting) Walaupun SSL sudah aktif, laman web mungkin masih menunjukkan amaran⚠️ "Not Secure" jika ada gambar, CSS, atau skrip yang masih dimuatkan melalui
http://.F12→ Klik tab Console. Cari ralat Mixed Content.http://www.sazwan.fairbase.comdan gantikan denganhttps://www.sazwan.fairbase.comdalam seluruh pangkalan data (backup dahulu!).2. Kemas Kini Google Search Console & Analytics Google menganggap
http://danhttps://sebagai dua entiti berbeza.https://www.sazwan.fairbase.com.3. Aktifkan HSTS (HTTP Strict Transport Security) HSTS memaksa pelayar web untuk sentiasa menggunakan HTTPS dan mengelakkan serangan downgrade.
4. Semak Sijil Subdomain & Wildcard
Anda menyebut
www.sazwan.fairbase.com. Pastikan sijil juga meliputi domain utama tanpa www:sazwan.fairbase.comDANwww.sazwan.fairbase.commempunyai padlock hijau.5. Tetapkan Auto-Renewal & Pemantauan
Sijil Let's Encrypt/AutoSSL biasanya sah selama 90 hari.
6. Uji Gred Keselamatan SSL
Jangan anggap SSL aktif = SSL selamat. Konfigurasi lemah boleh mendapat gred C atau F.
www.sazwan.fairbase.com.Senarai Semak Ringkas Pasca-Aktivasi
Adakah anda mahu saya bantu dengan mana-mana langkah spesifik di atas? Contohnya, saya boleh berikan arahan terperinci untuk menggantikan pautan Mixed Content dalam WordPress atau konfigurasi HSTS yang selamat untuk server anda. Here is a comprehensive guide to enabling HTTPS across the most common web platforms. Since you previously asked in Malay, this guide is provided in Bahasa Melayu for consistency, covering platforms beyond cPanel.
1. WordPress (Self-Hosted)
Selepas SSL dipasang di server/hosting:
http://kepadahttps://.wp-config.phpuntuk memaksa SSL di dashboard:php define('FORCE_SSL_ADMIN', true);2. Blogger / Blogspot
Blogger menyediakan SSL percuma secara terbina dalam:
http://luaran, kemudian cuba lagi selepas 24 jam.3. VPS / Server Sendiri (Ubuntu/Debian + Nginx/Apache) Gunakan Certbot (Let's Encrypt) – percuma & auto-renew:
Nginx:
Apache:
sudo apt update && sudo apt install certbot python3-certbot-apache sudo certbot --apache -d domain.com -d www.domain.com sudo certbot renew --dry-runDocker / Reverse Proxy (Caddy):
Caddy mengaktifkan HTTPS secara automatik tanpa sebarang konfigurasi tambahan:
4. Cloudflare (CDN / Proxy)
Sesuai jika domain sudah di-proxy melalui Cloudflare:
5. Platform E-Commerce & Website Builder
6. Localhost / Development Environment
Untuk tujuan pembangunan sahaja, bukan produksi:
Tidak kira platform apa pun, sentiasa lakukan perkara ini selepas mengaktifkan HTTPS:
http://domain.com→ Mesti bertukar kehttps://CodeAnt-AI Description
Add a guide for enabling HTTPS across common hosting platforms
What Changed
Impact
✅ Easier HTTPS setup✅ Fewer insecure site warnings✅ Clearer post-SSL setup checks💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.