Different websites show with http or https

[wickham]

Very strange. I run a village website which is not https , it just starts with http://www. although I am thinking of getting an SSL certificate.

However, just now I accidentally entered the url with https://www. and it showed a completely different website about holiday cottages all over the UK.

How did this happen? As I'm thinking of getting an SSL, I'm thinking that someone else has already got the domain name with SSL.

[mc2fool]

Very strange. I run a village website which is not https , it just starts with http://www. although I am thinking of getting an SSL certificate.

However, just now I accidentally entered the url with https://www. and it showed a completely different website about holiday cottages all over the UK.

How did this happen? As I'm thinking of getting an SSL, I'm thinking that someone else has already got the domain name with SSL.

No, that's not the issue. It's a server (mis) configuration. http & https are just protocol specifiers. As far as domain names go there is only one and it's yours. However, the server can be configured to serve different content depending on the protocol, so you could, e.g. have two home pages that say "Hey, this is my secure/insecure site", although most commonly you'd just have http access direct to https.

Complain to your hosting provider. If you aren't set up with a certificate https access to your domain should either redirect to http or have your browser say "not secure". It really shouldn't show someone else's domain!

[superFoolish]

There's a chance that you have misconfigured something on your hosting panel but, if not, have words with your hosting company. Probably a misconfiguration sending all sites without a SSL certificate to the primary https site on the server.

I'm not an expert on this, but guessing that the holiday cottage site is on the same IP address as your site (try a trace), and is the site with the primary SSL certificate in the web server config files. This means that all non-http sites with the same IP address as you, probably all end up showing the holiday cottage site.

If it's not a misconfiguration by you, ask your host for a very clear explanation of how they have misconfigured their server. I'd be tempted to move hosts.

[UncleEbenezer]

A misconfiguration is likely.

But it's not necessarily the hosting provider. It's also quite likely to be your own ISP. Some cowboys - like Virgin Media - will hijack requests that go nowhere (like https://your.domain until and unless you actually set it up) for profit.

Historically, https was incompatible with virtual hosts[1]. That changed with the introduction of SNI[2] So another plausible explanation, is that some component involved simply doesn't support SNI.

[1] Specifically, name-based virtual hosts. Which means in practice the vast majority of virtual hosts, unless you pay for a premium service.
[2] https://tools.ietf.org/html/rfc6066 . Or https://en.wikipedia.org/wiki/Server_Name_Indication .

[didds]

good advice above.

WRT getting a cert - I really wouldn;t bother unless there is content or a login etc from users that would be exposed over open-text http traffic. its just more hassle and cost (although there is at least one free cert provider out there - google for them).

If you don't need a https site [1] then turn simply off the https (typically port 443) provision. A https-> http redirect will still need a SSL certificate in place to not respond with a SSL error publically.

Meanwhile is theer an error shown when you load the https site you mention? try https://<your domain>/loadofoldruubbishthatwontlikelybeapath
- does it respond with a SSL error? If not depending on your browser you can check what certificate its using because without an error this indicates somebody has a cert that includes your domain name in it already [ likely the web provider and this sint; always "bad" or "dodgy" aside from whatever use they make of the redirect as explained in the OP. ] If you PM me with your domain name I'd be happy to do this simple check for you.

didds

[1 ] caveat : IIRC google (?) is starting to flag non https sites now as unsafe, which is NOT strictly true. Its only unsafe if there is unsafe informatioin being transmitted - see above

[wickham]

There's no error shown. I've just tried again and I get the popup saying there's a problem with the certificate and showing two options, cancel or go ahead. Go ahead shows the UK & Ireland Cottage Holidays website, totally unrelated to my village information website.

I'm not going to get an SSL certificate yet. I'll wait to see if it becomes a usual trend.

[didds]

PM'd you wickham

didds

[Lanark]

[1 ] caveat : IIRC google (?) is starting to flag non https sites now as unsafe, which is NOT strictly true. Its only unsafe if there is unsafe informatioin being transmitted - see above

There are lots of situations when seemingly innocent data can reveal a lot about you.

You don't have to be typing in a credit card for the metadata to be useful to someone, and god knows the internet is full of sneaky tracking software that follows your every move online.

For example reading a bunch of websites about breast feeding and baby names = you or someone you know may be pregnant.
or reading a bunch of websites about throat cancer = you just got a diagnosis.

More security is ALWAYS better.

[AndyPandy]

[1 ] caveat : IIRC google (?) is starting to flag non https sites now as unsafe, which is NOT strictly true. Its only unsafe if there is unsafe informatioin being transmitted - see above

It's stated it will also boost SEO rankings of Secure sites. Not by much as this 2014 report shows, but things may have changed.

https://searchengineland.com/google-sta ... tes-199446 (no connection).

If anyone uses 1&1 (Now Ionos) for Hosting, you get 1 free SSL Certificate and it was a doddle to migrate, although I'm still finding HTTP links on my Wordpress site. They all needed manually converting (although I'm sure I could have run a command line search and replace at the time if my linux skills were up to scratch).