Going live: hosts, HTTPS and siteaccesses #

This page is for website creators who put a site on its real host names. Three things must agree: DNS sends the host to your server, the server (Velocity or a web server) answers it with a certificate, and Exponential maps the host to the right siteaccess.

Contents #

1. Map hosts to siteaccesses
2. SiteURL
3. HTTPS
4. One host, one scheme
5. Behind a proxy
6. Checks

Map hosts to siteaccesses #

# settings/override/site.ini.append.php
[SiteAccessSettings]
MatchOrder=host;uri
HostMatchType=map
HostMatchMapItems[]
HostMatchMapItems[]=www.example.com;site
HostMatchMapItems[]=admin.example.com;admin

The empty line clears inherited entries; list every siteaccess you need (10.2 Siteaccesses and site addresses). HostMatchMethod=start lets a test host like www.example.com.test.local reach the same siteaccess (Siteaccess by host prefix).

SiteURL #

Set [SiteSettings] SiteURL in each siteaccess to its public host without scheme (www.example.com). Links in mail, feeds and sitemaps are built from it. Then clear the INI cache.

HTTPS #

Every host name of every siteaccess must be in the certificate. Add Strict-Transport-Security once HTTPS works everywhere (8.3.9).

One host, one scheme #

Redirect http:// to https:// and the other spellings (example.com) to the one you chose (www.example.com) in the server, with a 301. One address per page is better for visitors and search engines.

Behind a proxy #

When a load balancer or CDN terminates HTTPS, list its address in [HTTPHeaderSettings] TrustedProxies[]; otherwise the site believes every request is plain HTTP and records the proxy's address as every visitor's (8.8 Behind a reverse proxy).

Checks #

php bin/php/ezcache.php --clear-tag=ini --allow-root-user
curl -s -o /dev/null -w '%{http_code}\n' https://www.example.com/
curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' https://admin.example.com/
curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://example.com/

Expect 200 for the site, a redirect to the login for the administration, and a 301 to https://www.example.com/ for the other spelling. If two hosts answer the same, the host map does not match: the host must be exactly as the browser sends it, lower case, without port.

Related pages #

• The launch checklist
• Setting up several sites in one installation
• Hosting requirements for a website
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.