0

I have bought domains from A company.

My all sites were in shared hosting account on Company B.

I have moved my all sites to shared hosting account on Company C from B. I know the all the steps.

Now I wanted to move my sites from company C to company B. But now my sites have HTTPS thanks to Let's Encrypt and Really Simple SSL WordPress plugin.

Is there any extra step should I do when moving my sites from new hosting account because of now I having HTTPS?

  • Redirect all non-ssl traffic to SSL. – Simon Hayter Jul 2 '18 at 18:23
  • @SimonHayter I have already done it on current hosting. Do I need to do some more after migrating too? – I am the Most Stupid Person Jul 3 '18 at 3:55
  • Have you served an HSTS header, and are you on the preload list? – jrtapsell Jul 5 '18 at 9:57
  • @jrtapsell HSTS header?? Preload list means? – I am the Most Stupid Person Jul 5 '18 at 9:59
  • 1
    The question not pointed on true fog. is it about your site, your domain or your hosting? you have ssl. if you changed IP (because of changing your hosting) so you need to renew (reissue) your SSL certificates. – M.Abooali Jul 5 '18 at 21:58
-2

Is there any extra step should I do when moving my sites from new hosting account because of now I having HTTPS?

add

    Options -Indexes

to the .htaccess to prevent directory surfing. add these to prevent common attacks in .htaccess: deny all access to hidden files/directories.:

    RewriteCond %{SCRIPT_FILENAME} -d [OR]
    RewriteCond %{SCRIPT_FILENAME} -f
    RedirectMatch 404 /\..*$

These are to stop mysql injections and other exploits, but I had originally just two rewrite conditions. However, I'm updating this list to include other attacks (update)

     RewriteCond %{QUERY_STRING} ^(%2d|\-)[^=]+$ [NC,OR]
     RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http:// [OR]
     RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=(\.\.//?)+ [OR]
     RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=/([a-z0-9_.]//?)+ [NC,OR]
     RewriteCond %{QUERY_STRING} \=PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC,OR]
     RewriteCond %{QUERY_STRING} (\.\./|\.\.) [OR]
     RewriteCond %{QUERY_STRING} ftp\: [NC,OR]
     RewriteCond %{QUERY_STRING} http\: [NC,OR]
     RewriteCond %{QUERY_STRING} https\: [NC,OR]
     RewriteCond %{QUERY_STRING} \=\|w\| [NC,OR]
     RewriteCond %{QUERY_STRING} ^(.*)/self/(.*)$ [NC,OR]
     RewriteCond %{QUERY_STRING} ^(.*)cPath=http://(.*)$ [NC,OR]
     RewriteCond %{QUERY_STRING} (\<|%3C).*script.*(\>|%3E) [NC,OR]
     RewriteCond %{QUERY_STRING} (<|%3C)([^s]*s)+cript.*(>|%3E) [NC,OR]
     RewriteCond %{QUERY_STRING} (\<|%3C).*iframe.*(\>|%3E) [NC,OR]
     RewriteCond %{QUERY_STRING} (<|%3C)([^i]*i)+frame.*(>|%3E) [NC,OR]
     RewriteCond %{QUERY_STRING} base64_encode.*\(.*\) [NC,OR]
     RewriteCond %{QUERY_STRING} base64_(en|de)code[^(]*\([^)]*\) [NC,OR]
     RewriteCond %{QUERY_STRING} GLOBALS(=|\[|\%[0-9A-Z]{0,2}) [OR]
     RewriteCond %{QUERY_STRING} _REQUEST(=|\[|\%[0-9A-Z]{0,2}) [OR]
     RewriteCond %{QUERY_STRING} ^.*(\[|\]|\(|\)|<|>).* [NC,OR]
     RewriteCond %{QUERY_STRING} (NULL|OUTFILE|LOAD_FILE) [OR]
     RewriteCond %{QUERY_STRING} (\./|\../|\.../)+(motd|etc|bin) [NC,OR]
     RewriteCond %{QUERY_STRING} (localhost|loopback|127\.0\.0\.1) [NC,OR]
     RewriteCond %{QUERY_STRING} (<|>|'|%0A|%0D|%27|%3C|%3E|%00) [NC,OR]
     RewriteCond %{QUERY_STRING} concat[^\(]*\( [NC,OR]
     RewriteCond %{QUERY_STRING} union([^s]*s)+elect [NC,OR]
     RewriteCond %{QUERY_STRING} union([^a]*a)+ll([^s]*s)+elect [NC,OR]
     RewriteCond %{QUERY_STRING} (;|<|>|'|"|\)|%0A|%0D|%22|%27|%3C|%3E|%00).*(/\*|union|select|insert|drop|delete|update|cast|create|char|convert|alter|declare|order|script|set|md5|benchmark|encode) [NC,OR]
     RewriteCond %{QUERY_STRING} (sp_executesql) [NC]
     RewriteRule ^(.*)$ - [F,L]

we can add other bad requests and deny user agents ect. looks like this hosting guy goes into detail about it. https://secure.rivalhost.com/knowledgebase/1037/htaccess-against-MySQL-injections-and-other-hacks.html

  • it seems like the hackers on-line on this forum don't want this out...lol – drtechno Jul 5 '18 at 17:46
  • I didn't downvote, but you're not really answering the question with regards to the HTTP to HTTPS migration - there's nothing specific to HTTPS here. Your code block is without any explanation of what it actually does (how does it "prevent common attacks"?). One thing you should never do is use code in .htaccess that you don't understand... it doesn't look like those directives actually do anything? The two conditions that check against the QUERY_STRING are mutually exclusive so the rule will never be successful. That RedirectMatch (mod_alias) directive is certainly misplaced. – MrWhite Feb 22 at 10:14
  • I'll clarify it for you.. – drtechno Feb 22 at 17:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.