Archived topic
Non-https references in theme
5 replies · Started by savedaws on October 16, 2018
I am getting dinged because our site has some non-https references that appear to be coming from the theme. I realize that these are not actual links, but I would still like to find a way to update them.
Here are the error messages I'm getting from some of the tools:
Your website's URLs do not redirect to HTTPS pages.
Your headers are not properly set up to use HSTS.
I have searched the db and updated all http to https that I have control over changing.
Remaining are these:
<html lang="en-US" prefix="og: http://ogp.me/ns#">
<nav itemtype="http://schema.org/SiteNavigationElement" itemscope="itemscope" id="mobile-header" class="main-navigation mobile-header-navigation">
<footer class="fl-builder-content fl-builder-content-4960 fl-builder-global-templates-locked" data-post-id="4960" itemscope="itemscope" itemtype="http://schema.org/WPFooter" data-type="footer">Hi there,
Those are false positives. One of them is coming from Beaver Builder, one from the theme and one from GP Premium.
There's no easy way to change them to https, but they have no negative effect on your website at all.
Tom,
They may have no effect on actual security, but we just had someone refuse to register and pay for a membership because the site shows up with a big "Not secure, don't enter your info" information on it in Safari. We are using GP Premium and Elementor. I will check Elementor but would like GP Premium to be fixed.
Regards, Les
Those references won't prompt any messages from browsers.
For example, this site we're on right now has the references, but there are no security warnings in any browsers.
Yes Tom, they do cause warning messages from browsers, which is why I originally logged the topic. Unfortunately those references I've listed are generated by GP. Is there a way for me to update them myself, since you don't seem willing? The links are actually out of date.
That's strange - what browser/version are you seeing the warnings in? Are you getting them here on generatepress.com? Any chance I can see a screenshot so I know what to look for?
The first one is standard in WordPress: http://ogp.me/
It doesn't actually make a call to that website, so there's no data being transferred whatsoever. That means there's no security risk. https://ogp.me/ doesn't exist.
You can remove it in the header.php file - be sure to use a child theme so it's not lost when you update.
The second one is microdata, which again doesn't make a call to the website.
You can find it in wp-content/plugins/gp-premium/menu-plus/functions/generate-menu-plus.php. It will be removed in GPP 1.7.4/1.8 as we're moving away from microdata to JSON-LD.
The third one is also microdata, and is added by Beaver Builder. You'll need to ask them how to remove it from their plugin.
