Cloudflare, HTTPS, Site Security

[StarWeaver]

Sooo I was logging back in over here now that the site's back up and I noticed that the login form and everything is HTTP only. (Of course I tried forcing HTTPS but that just got me a confused SiteGround cpanel site's 404).

I'm guessing from that configuration that your hosting provider doesn't make it easy to provide HTTPS services without forking over a premium.

Now in isolation the threat of people being impersonated on this forum isn't very large. But people, as a whole, are really, really bad about password reuse between sites. There are almost certainly a fair number of username/password combinations on this site that are also used on Steam or even banks. You don't want to be responsible for people getting their Steam account stolen, if you can help it.

Which is why I'd seriously recommend stuffing the site through Cloudflare, with their Flexible SSL setting. It won't protect against everyone, but it will protect against anyone between me and the other end of Cloudflare's network, and that's a hell of a lot. For free. While (probably significantly) reducing the bandwidth load on your own host, thus making outages less likely / your costs lower.

Here's quite a detailed discussion of things related to this: https://www.troyhunt.com/cloudflare-ssl ... bsolutism/


Also, since I'm talking about security, after glancing at the I'm hoping your site software's seen patches since 2007.

[polycount]

To add on to this, Cloudflare's HTTPS is actually free to use. You don't have to pay for their monthly sub or anything to make use of it. I have a WP blog with HTTPS, thanks to Cloudflare - Got a nice ranking boost out of it, too!

I definitely agree with the OP here. Cloudflare (Even the free plan) is the way to go to keep things safe and secure around here.