Cloudflare, HTTPS, Site Security
Posted: Tue Nov 01, 2016 5:06 pm
Sooo I was logging back in over here now that the site's back up and I noticed that the login form and everything is HTTP only. (Of course I tried forcing HTTPS but that just got me a confused SiteGround cpanel site's 404).
I'm guessing from that configuration that your hosting provider doesn't make it easy to provide HTTPS services without forking over a premium.
Now in isolation the threat of people being impersonated on this forum isn't very large. But people, as a whole, are really, really bad about password reuse between sites. There are almost certainly a fair number of username/password combinations on this site that are also used on Steam or even banks. You don't want to be responsible for people getting their Steam account stolen, if you can help it.
Which is why I'd seriously recommend stuffing the site through Cloudflare, with their Flexible SSL setting. It won't protect against everyone, but it will protect against anyone between me and the other end of Cloudflare's network, and that's a hell of a lot. For free. While (probably significantly) reducing the bandwidth load on your own host, thus making outages less likely / your costs lower.
Here's quite a detailed discussion of things related to this: https://www.troyhunt.com/cloudflare-ssl ... bsolutism/
Also, since I'm talking about security, after glancing at the I'm hoping your site software's seen patches since 2007.
I'm guessing from that configuration that your hosting provider doesn't make it easy to provide HTTPS services without forking over a premium.
Now in isolation the threat of people being impersonated on this forum isn't very large. But people, as a whole, are really, really bad about password reuse between sites. There are almost certainly a fair number of username/password combinations on this site that are also used on Steam or even banks. You don't want to be responsible for people getting their Steam account stolen, if you can help it.
Which is why I'd seriously recommend stuffing the site through Cloudflare, with their Flexible SSL setting. It won't protect against everyone, but it will protect against anyone between me and the other end of Cloudflare's network, and that's a hell of a lot. For free. While (probably significantly) reducing the bandwidth load on your own host, thus making outages less likely / your costs lower.
Here's quite a detailed discussion of things related to this: https://www.troyhunt.com/cloudflare-ssl ... bsolutism/
Also, since I'm talking about security, after glancing at the I'm hoping your site software's seen patches since 2007.