I just noticed that trying to visit one of the per-site metas using HTTPS will (after confirming the security exception due to the ) give a 403 error:    Yes, I know that .  But the per-site metas used to work over HTTPS, so this is a regression.  I did some extra testing, and it appears that this error shows up only for the per-site metas with a four-part hostname of the form meta.sitename.stackexchange.com.  That is, the following meta sites with custom domains work fine over HTTPS:           but any other per-site metas, (like, say, ) are broken.  From the error message, I suspect this regression has something to do with the use of the CloudFlare CDN.  Perhaps something needs to be (re)configured in SE's CloudFlare settings to make this work again?
122218
Clicking on  doesn't connect me with the meta S.Ex.SE site.  EDIT: For some entry points, . Observation courtesy Gilles.  I consider it a pity that the devs have not paid attention to this issue nor have indicated that they noted the problem. While HTTPS is not yet official on this network, I refrain from using unencrypted connections. I can't participate in metas, oh well.  EDIT #2 (2015-11-07) - with the switch to CloudFlare SSL the problem looks finally resolved.  EDIT #3 (2015-11-17) - still getting 403 Forbidden from CloudFlare. D'rats!..  EDIT #4 (2016-01-11) - We're still there. It's 2016 already... Starting a bounty.
102106
The problem is a whole load of 404 errors, as reported by Google Webmaster Tools, with pages and queries that have never been there. One of them is viewtopic.php, and I've also noticed a scary number of attempts to check if the site is a WordPress site (wp_admin) and for the cPanel login. I block TRACE already, and the server is equipped with some defense against scanning/hacking. However, this doesn't seem to stop. The referrer is, according to Google Webmaster, totally.me.  I have looked for a solution to stop this, because it isn't certainly good for the poor real actual users, let alone the SEO concerns.  I am using the Perishable Press mini black list (), a standard referrer blocker (for porn, herbal, casino sites), and even some software to protect the site (XSS blocking, SQL injection, etc). The server is using other measures as well, so one would assume that the site is safe (hopefully), but it isn't ending.  Does anybody else have the same problem, or am I the only one seeing this? Is it what I think, i.e., some sort of attack? Is there a way to fix it, or better, prevent this useless resource waste?  EDIT I've never used the question to thank for the answers, and hope this can be done. Thank you all for your insightful replies, which helped me to find my way out of this. I have followed everyone's suggestions and implemented the following:   a honeypot a script that listens to suspect urls in the 404 page and sends me an email with user agent/ip, while returning a standard 404 header a script that rewards legitimate users, in the same 404 custom page,  in case they end up clicking on one of those urls. In less than 24 hours I have been able to isolate some suspect IPs, all listed in Spamhaus. All the IPs logged so far belong to spam VPS hosting companies.   Thank you all again, I would have accepted all answers if I could.
92752
I have been having problems with this for a while and have tried everything I know, so I figured it was finally time to ask for some help.  Any edit I make to /etc/hosts just doesn't work.  Example:  julian@ifrit:~$ cat /etc/hosts 127.0.0.1   localhost 127.0.1.1   ifrit 192.168.1.100   dev.julianfernand.es   In the example above, when I access dev.julianfernand.es (this doesn't exist), it should load from 192.168.1.100.  If I ping, it works just fine. However when I access dev.julianfernand.es using Google Chrome or Firefox, it doesn't.  Now, after I restart a couple times, it works. But since I work at a managed WordPress hosting company, I deal with many situations where I have to edit my file to see the customer's website on our server.  I just can't keep restarting my computer. It isn't productive at all. Restarting the networking service doesn't work, same for clearing cache (even internal Chrome DNS cache).  Does anyone have an idea here? This happens with elementaryOS (based on Ubuntu 12.04) and Ubuntu 13.10 (daily). Haven't tried with any other version yet.  PS: if this matter, I have a NGINX server running on this machine with PHP-FPM and MySQL.  Thanks in advance :)
48829
This is a  about redirecting from http to https in Apache Related:     I have an Appache web server which serves both http://example.com/ and https://example.com/. I want to redirect all http requests to https. Currently I'm using this .htaccess rule to redirect http requests to https. RewriteEngine On RewriteBase / RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}   It's working as expected for example.com but the same rule is not working for sub links, when I access existing links, like example.com/about it will still load in http, no redirection happens for existing links. How can I make Apache redirect all http requests to https?
112718
The Problem  Accessing my site over https (the only protocol allowed) I get the content, but none of the CSS, images etc.  Drupal is creating pages in response to https requests that include http links to these resources, but it should be using https.  What I've done  I have copied a site to a dev server. The site loads and basically works fine - I can log in etc. It's just that all the links drupal generates are http. The site I've copied it from also runs over https. The site does not exist on http (it would just get a Forbidden error). I've drush cc all.  So Apache's working - I can access the site. .htaccess is working (clean urls work, for example).  I'm using SNI to access the site because the server has other vhosts too, but I'm only accessing the site using the latest Firefox (and as it's a dev site and I'm the only dev, nobody else will use it).  I've done this dozens of times and am quite stumped! Why does Drupal not notice that the request came over https?  The fix  Turns out that .htaccess has this to say:   /* Base URL (optional).                                                          If Drupal is generating incorrect URLs on your site, which could             be in HTML headers (links to CSS and JS files) or visible links on pages     (such as in menus), uncomment the Base URL statement below (remove the       leading hash sign) and fill in the absolute URL to your Drupal installation.    Sure enough, putting $base_url = 'https://example.com'; fixed it.  But why is this necessary?
82932
I have set up a LAMP server and I have access via SSH and to the "it works" page from a web browser from inside my network (via ip address) and from outside using dyndns.  We have some Wordpress projects that sit in subdirectories in /var/www/wordpress1 /var/www/wordpress2, etc.  I cannot access these sub directories from a browser in order to set up WP--or (I assume) to see the content on a browser. I get a 403 Forbidden error on my browser.  I assume that this is a permissions problem.  Can you please tell me the proper settings for the permissions to:   Allow the developers and me to read/write. to allow WP set up and do its thing Allow visitors to access the site(s) via the web.   I should also mention that the subfolder are actually simlinks to folder on another internal hdd--I don't think this will make a difference, but I thought I should disclose.  total 12 drwxr-xr-x  2 root root 4096 2012-07-12 10:55 . drwxr-xr-x 13 root root 4096 2012-07-11 20:02 .. lrwxrwxrwx  1 root root   43 2012-07-11 20:45 admin_media -&gt;     /root/django_src/django/contrib/admin/media -rw-r--r--  1 root root  177 2012-07-11 17:50 index.html lrwxrwxrwx  1 root root   14 2012-07-11 20:42 media -&gt; /hdd/web/media lrwxrwxrwx  1 root root   18 2012-07-12 10:55 wordpress -&gt; /hdd/web/wordpress   Here is the result of using chown -R www-data:www-data /var/www  total 12 drwxr-xr-x  2 www-data www-data 4096 2012-07-12 10:55 . drwxr-xr-x 13 root     root     4096 2012-07-11 20:02 .. lrwxrwxrwx  1 www-data www-data   43 2012-07-11 20:45 admin_media -&gt; /root/django_src/django/contrib/admin/media -rw-r--r--  1 www-data www-data  177 2012-07-11 17:50 index.html lrwxrwxrwx  1 www-data www-data   14 2012-07-11 20:42 media -&gt; /hdd/web/media lrwxrwxrwx  1 www-data www-data   18 2012-07-12 10:55 wordpress -&gt; /hdd/web/wordpress   I am still unable to access via browser.
58297
UPDATE: Since Area 51 is not supporting SSL yet. But the Area 51 link in the footer of Meta Stack Exchange site and in the Your Communities dropdown list contains https://, clicked from there it caused the insecure connection issue.   Actual post When I click the  link in the bottom of the , I received the insecure connection issue.  In Google Chrome:  In plain text:  Your connection is not private Attackers might be trying to steal your information from discuss.area51.stackexchange.com (for example, passwords, messages or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID  In Mozilla Firefox:  In plain text:  Your connection is not secure The owner of discuss.area51.stackexchange.com has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.
42539
Previously I asked a question here:  about setting up secure and non-secure domains on a single IP.  Opinions were mixed, but it appears SNI hold the solution. Unfortunately I cannot get it work as required.    — Works as expected  — Presents domaina.com certificate, not as expected. I would like it to not respond to SSL requests.   I would like my server to only send the certificate for domaina.com and no other host names, even if this means sending a 403 error to non-SNI clients. My current configuration on vanilla Ubuntu Server 12.04 LTS is below:  Ports.conf  … &lt;IfModule mod_ssl.c&gt;     NameVirtualHost *:443     Listen 443 &lt;/IfModule&gt; …   Domain A Virtual Host  &lt;VirtualHost *:80&gt;     ServerName   domaina.com     ServerAlias  www.domaina.com     DocumentRoot /var/www/domaina.com/public     ErrorLog     /var/www/domaina.com/logs/error.log     CustomLog    /var/www/domaina.com/logs/access.log combined &lt;/VirtualHost&gt;  &lt;IfModule mod_ssl.c&gt; &lt;VirtualHost *:443&gt;     ServerName   domaina.com     ServerAlias  www.domaina.com     DocumentRoot /var/www/domaina.com/public     SSLEngine on     SSLCertificateFile      /etc/apache2/ssl/domaina.com.crt     SSLCertificateKeyFile   /etc/apache2/ssl/domaina.key     SSLCertificateChainFile /etc/apache2/ssl/domaina.com.ca-bundle &lt;/VirtualHost&gt; &lt;/IfModule&gt;   Domain B Virtual Host  &lt;VirtualHost *:80&gt;     ServerName   domainb.com     ServerAlias  www.domainb.com     DocumentRoot /var/www/domainb.com/public     ErrorLog     /var/www/domainb.com/logs/error.log     CustomLog    /var/www/domainb.com/logs/access.log combined &lt;/VirtualHost&gt;   apache2ctl -S  VirtualHost configuration: wildcard NameVirtualHosts and _default_ servers: *:443                  is a NameVirtualHost          default server domaina.com (/etc/apache2/sites-enabled/domaina.com:12)          port 443 namevhost domaina.com (/etc/apache2/sites-enabled/domaina.com:12) *:80                   is a NameVirtualHost          default server domaina.com (/etc/apache2/sites-enabled/domaina.com:3)          port 80 namevhost domaina.com (/etc/apache2/sites-enabled/domaina.com:3)          port 80 namevhost domainb.com (/etc/apache2/sites-enabled/domainb.com:1) Syntax OK   How can you get rid of the defaults?
82907
For about 2 weeks, multiple people (around 10 that I know of) in our company are having trouble accessing Stack Overflow; independently of the browser, and on Linux as well as Windows. The symptom is that assets loaded from cdn.sstatic.net keep waiting forever or until they time out.   On my machine the status is that at some point those requests time out and a version of the page without any images or CSS appears.  For some Windows users reboots help, for others it doesn't.   Meta Stack Overflow (now Meta Stack Exchange) always loaded for me.  A workaround for my machine was to disable IPv6 temporarily on Linux with the command echo 1 | sudo tee /proc/sys/net/ipv6/conf/all/disable_ipv6.  Note that no other site (that I visit) has been affected like this.  Update 2013-08-12: our network guy did some checking and insists the problem lies with Cloudflare. We seem to have issues when trying to connect to them with IPv6. We can't go around and disable our IPv6 Support since we need it for our internal infrastructure. We employ the following workaround (sadly only works with Firefox):   Go to about:config find the configuration key called network.dns.ipv4OnlyDomains Set it to the following list of domains (or add them if you already have something in this key): cdn.sstatic.net,www.cloudflare.net,cdn-careers.sstatic.net
91575
I'm trying to get apache to redirect from http to https, however I want them both on the same port (20100, but I doubt that will matter). Basically what's going on  except I'm not doing this for webmin. Currently I have it configured to serve HTTPS, and when I access with HTTP I get:  Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.   There seem to be a lot of somewhat similar questions, however I am unable to find one that actually answers my question.
63190
I have changed my website from HTTP to HTTPS.  At this moment, I have the next rewrite rule working to redirect calls for HTTP to HTTPS:  RewriteEngine On  RewriteCond %{SERVER_PORT} 80  RewriteRule ^(.*)$ https://example.net/$1 [R,L]    Should I write the URLs on the sitemap with HTTP or with HTTPS? (including the homepage)
55027
I had something set up wacky in our DNS setup which is now resolved. The remaining problem is that chrome has cached the incorrect setup. Specifically, when using Chrome http://example.com is now redirecting to https://example.com (naked domain), which is not valid/supported.  http://example.com SHOULD redirect to http://www.example.com and then force https://www.example.com. But on a handful of browsers (including mine) this doesn't happen because of some funky Chrome caching. I tried going to “Privacy -&gt; Clear Cache” but it had no effect.
20904
Here's something interesting I noticed today - it is not possible to name a post a number - no matter what theme you use, and even if you name a post a long number that has no tag or post-name or category name conflicts, you will still get 2015 or 1826628 renamed as 2015-2 or 1826628-2.  I assume this isn't a bug, but I also don't see why you can't have mysite.com/20 or similar as a permalink to a post, when you have it named "20", and permalinks are set to postname.
88602
The links to other StackExchange sites in User profile -> Summary -> Accounts don't use https when the User profile was accessed using https.
101625
Google Chrome 41.0.2272.118, Ubuntu 14.04    This is the second time I have had this error in the last week or so. Is this a bug on my part, or is there something up with the SE security certificate?  I've changed to bug because of :     No, it's something Stack Exchange would have to fix. Chrome is following the rules. But considering the whole meta.*.stackexchange.com dilemma is what's been holding up a lot of the HTTPS support, I doubt they're going to come up with any kind of fix for the www.*.stackexchange.com redirect problem. –  animuson♦
66941
I am rebuilding an old server.  Only one of the five old sites need to go live and all five of the old sites point to the same IP address.  Unfortunately any time a request is made for one of the old sites via their own unique domain names they are passed the pages from the one site that I'm trying to make live.  I would just like the old sites to display a 404 instead of the one site that I'm actually trying to make live.  As an example:   Site 1 (192.168.0.1) [www.first.com] Site 2 (192.168.0.1) [www.second.com] Site 3 (192.168.0.1) [www.third.com]   I want to move site 1 live again.  So I turned on apache on the machine with the IP address of 192.168.0.1, with all of site 1's files in the /var/www directory.  When I browse to 192.168.0.1 or www.first.com I correctly see site 1. When I browse to www.second.com and www.third.com I also receive site 1 which is the problem.  Is there a way I can 404 any request which comes in without www.first.com?  Here is my sites-available:  NameVirtualHost *:80  LogFormat "%h %l %u %t \"%r\" %&gt;s %b" common  &lt;Files ~ "^\.ht"&gt;     Order allow,deny     Deny from all     Satisfy All &lt;/Files&gt;  &lt;Directory /&gt;   Order Deny,Allow   Deny from all   Options None   AllowOverride None   Options None &lt;/Directory&gt;  &lt;Directory /var/www&gt;   Order Allow,Deny   Allow from all &lt;/Directory&gt;  &lt;VirtualHost *:80&gt;         ServerName first.com         ServerAlias www.first.com         DocumentRoot /var/www         ErrorLog /var/log/first.com.err         CustomLog /var/log/first.com.log common &lt;/VirtualHost&gt;  &lt;VirtualHost _default_:*&gt;         ServerName unknown         DocumentRoot /var/www_404 &lt;/VirtualHost&gt;
95962
When you post a link from Stack Exchange into the chatbox using HTTPS, the link does not onebox. However, if you change the link to HTTP, it works. See the screenshot below:    HTTPS URLs should onebox, too.