I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).
The website is hosted on a shared platform, and I've bought unique IP + Comodo SSL certificate at my webhost, they will take care of the installation.
Next monday the website will be tested by an audit company, so I need to be sure everything is perfectly secured. The web application itself and the server are perfectly secured conforming the requirements (done by a collegue with decent skills) - it's just the SSL that still needs to be installed.
My questions:
- Does this require extra configuration in the website source code?
- Does this mean the website can not be reached over http, and only over https? My webhost told me I could see the https as an extra feature, and regular http will also remain available. So how can I be sure that all traffic goes over https?
(Sorry for my noob questions - I'm a designer, not a server specialist - and I have absolutely no experience with SSL..)
Thanks!