1. Install an SSL Certificate: An SSL certificate is a necessary requirement for an SSL connection. You can either get one for free from Let’s Encrypt or purchase one from a certifying authority like SSL.com, DigiCert, and others.
1. Redirect Your Website to HTTPS: By redirecting your site to HTTPS, you ensure that all visitors to your website will be secured with an SSL encryption. There are numerous ways to handle such a redirect depending on your webserver. For Apache servers, update your .htaccess file with the following code:
RewriteCond %{HTTPS} off
RewriteRule ^(.\*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
1. Update Configurations in Drupal 8: Navigate to Configuration → System → Trusted Host Patterns and add your domain.
Add the following line to the end of the settings.php file in Drupal.
$conf[‘https’] = TRUE;
1. Change Base URL to HTTPS: Navigate to Configuration → System → Basic Site Settings and update the Base URL of your website with HTTPS.
1. Use Secure Cookie: Navigate to Configuration → System → HTTPS and enable Secure Cookie checkbox.
1. Install SSL Checker module: The SSL Checker module evaluates SSL connections after their installation to verify their validity. It provides a report on the SSL connection with suggestions for improvements.
1. Use Content Security Policy (CSP): A useful feature of adding a CSP header for a Drupal site is to enable source whitelisting for third-party scripts, CSS, and fonts. It also protects your site from potential XSS (cross-site scripting) attacks.
Add the following code to your .htaccess file.
Header set Content-Security-Policy “default-src ‘self’;script-src ‘self’ https://ajax.googleapis.com “.
Conclusion
By taking the above steps, your website is secured with an SSL certificate, and you are using secure HTTPS connections to encrypt data. Your website visitors are protected from Man-in-the-Middle (MitM) attacks that attempt to steal sensitive information. You have also ensured that your Drupal website runs securely with a wide range of configurations that comply with web best practices for SSL security.
