Require https Does Not Always Work

Posted January 11, 2019

The Issue

Site managers can set their site to only show as https (SSL/secure) in Page Properties of their home page. However, in some cases, sites set as https can be opened as http, or even switch from https to http as visitors click through the site.

Normally when a site is set as 'secure', pages are routinely loaded as https instead of http by the servers. We have identified a server cache issue that interferes in this process, and http pages are incorrectly loaded.  The issue does not prevent https from working and does not lead to error pages, but it also continues to allow access via http even when in https-only mode.

Workaround

We are working on this issue, but until the problem is fixed, we suggest the following options:

  • Keep your site set as 'require https" but allow your pages to load as https or http. Your site is not broken, just displaying inconsistent behavior.
  • Turn 'require https' off on your site until the problem is fixed. Pages will load as http or https as requested by each visitor.