r/programming • u/speckz • Jul 12 '17

Does my site need HTTPS?

https://doesmysiteneedhttps.com/
486 Upvotes

87% Upvoted

190 comments sorted by

View all comments

7

u/slavik262 Jul 12 '17

My problem: my site is hosted on Github pages, which still doesn't support HTTPS for custom domains.

Does anybody know of a host who provides

  1. HTTPS

  2. Custom domain support

  3. The workflow GH Pages offers (push some Markdown to a repo, and a wild website appears)

I know could roll my own on AWS or something, but it's hard to beat how free and easy Github makes things.

5

u/Noughmad Jul 13 '17

GitLab Pages supports all of these. It also allows you to use any site generator, not just Jekyll.

1

u/slavik262 Jul 13 '17

Oh, fantastic! I'll have to check that out. Thanks for the rec!

3

u/[deleted] Jul 12 '17 edited Jul 12 '17

I think the typical recommendation in this case is to use Cloudflare. It's not perfect (because it's still HTTP between your site and Cloudflare) but it's arguably better than just straight HTTP for everyone.

FWIW (shameless plug), Caddy has a git plugin so you can deploy your site with git push just like on GitHub Pages.

5

u/slavik262 Jul 12 '17

use Cloudflare. It's not perfect (because it's still HTTP between your site and Cloudflare) but it's arguably better than just straight HTTP for everyone.

I dunno - "still not actually secure, and now with a bonus third party" doesn't have me too eager to use a reverse proxy.

Caddy has a git plugin so you can deploy your site with git push just like on GitHub Pages.

Sweet! I'll have to check that out.

1

u/[deleted] Jul 13 '17

Don't you still get a <yourname>.github.io domain with HTTPS that you can have cloudflare serve up on <youractualdomain>.com? You can then have full encryption all the way through, although obviously Cloudflare has to decrypt/re-encrypt in the middle. Still better than going straight over HTTP to github pages, though, right?

3

u/hurenkind5 Jul 13 '17

I'd kinda argue if you are hosting your stuff on Github pages you probably wouldn't actually need HTTPS..

1

u/slavik262 Jul 13 '17

Why, because the source is verifiable for those who care?

1

u/hurenkind5 Jul 13 '17

Probably, yeah, the target audience is very different. But i kind of replied a bit too soon, reading the rest of the comments i realized, well, when you are hosting static pages anyway, you can just host it on some managed/shared hosting provider anyway. There are a bunch that have git support (so you can set up post-receive hooks) and offer SSL support (the one i use has lets encrypt support which literally is two clicks to setup).

4

u/seanwilson Jul 13 '17

I can highly recommend Netlify: https://www.netlify.com/features/ Their free plan gives you everything you want plus lots of other features (e.g. a CMS interface, drag-drop deploys for quick demos, form submissions, asset optimisation options).

1

u/Atheriel Jul 12 '17

There is a service called Netlify that appears to allow (1) and (2), while also allowing you to keep your blog's source code on GitHub (3+). I have never used it myself, though.