Confirm website url in settings is actually set to HTTPS. I suspect this should make the default media urls https.

Note if the site url actually is HTTPS, we need to figure out a method to make img/media embeds default to https rather than the current http.

I have confirmed on stage that the following setting makes image embeds in posts default to https. Edit Site -> Settings -> Siteurl -> change http to https Note changing this also requires you to re-save permalinks even though you are not changing values. If you do not do this all links to blog posts will be broken. == Again To Fix This 2 Steps == 1. Edit Site -> Settings -> Siteurl -> change http to https -> save 2. Settings -> Permalinks -> dont change anything -> save I am not comfortable making this change in production until I do additional testing. I will update this bug when that occurs.

After testing on allizom I implemented this on the following large blogs: - Mozilla Websites https://blog.mozilla.org/websites/ - Mozilla Labs http://blog.mozilla.org/labs/ - Mozilla Web Development https://blog.mozilla.org/webdev I also implemented this on a minor blog: - /tanvi https://blog.mozilla.org/tanvi Everything tests out fine so I confident in us making these changes. I do have some questions for jake: 1. I can not change this setting for the main blog.mozilla.org either as a site or under network /. It is greyed and not editable. Is this something you can do? If so lets make the change on stage first and do a bunch of testing. If not.. how on earth to we change it! 2. There are 129 blogs under this network. I suggest I only update this setting for blogs that have had posts in 2013. Any others are likely inactive. Thoughts?

Jake: More info for you. 1. The url for blog.mozilla.org is likely in wp-config if you can change this on dev, I can test.

JD, adding you to the cc as you are on a roll fixing wp stuff, and this one is one I can not fix myself. Also it is a big one :) Feel free to ping me if you have questions.

Any updates on this. If not I will go ahead and start changing all the blog urls manually. I can do that for everything except the main blog. I would still need you to change this one, it is not exposed via the wp-admin and we should test on dev first.

I glanced at the main blog and the url is not set in the config file. I have not had the time to research if simply adding it will force the change or if some more indepth solution is needed. Before you commit a big chunk of time on this let me ask the DBAs for some input. I would bet that there is a way to construct a SQL query that can do this in short order. If not that we should figure a way to divide up the work and get a bunch of people to attack it at once. DBAs, can you please take a moment to let us know if this method is feasible and what the timeline might be if it is? Thanks in advance :)

Jason, I took a quick look at the database. It doesn't look like what we're looking for is easily accessible in the database. Here's what I found stored in the database: 1.) wp_users has the blog URL for each user's profile (custom field when creating your user account to where your blog is stored, may be a personal address) 2.) each blog has all of it's urls in a single table that were part of posts 3.) each blog has all the URLs from it's comment section. For: 1.) I cannot change all of those to https because they don't all point to blogmo. I can adjust the ones that do point to blogmo to https but I don't think these urls are followed often since they're only visible in a user's profile. 2.) In the majority of these cases, these are external links only. Nothing internal. 3.) Nothing to do with the blog itself. I will note that while I didn't find any other URL sections (at least that contained http vs https), there's a LOT of metadata stored in JSON for each blog. I could spend more time and dig into that metadata if need be.

I would note that changing the site url likely triggers some cascading changes. So changing via sql directly might be dangerous. I also noticed that when I change this manually, every blog post will 404 until I resave the permalink setting. See 866936#c2.

Brandon, it sounds like all 1-3 are <a href> links rather than embeds? i.e, clicking on them causes a user to navigate to an http location, but doesn't cause mixed content on the https blog. Is that true, or am I mistaken? We are trying to ensure that all content that is embedded (like images, objects, scripts) on blog.mozilla.org is HTTPS. Links that take users to HTTP pages are okay. (In reply to Brandon Johnson [:cyborgshadow] from comment #8) > Jason, > > I took a quick look at the database. It doesn't look like what we're looking > for is easily accessible in the database. Here's what I found stored in the > database: > > 1.) wp_users has the blog URL for each user's profile (custom field when > creating your user account to where your blog is stored, may be a personal > address) > 2.) each blog has all of it's urls in a single table that were part of posts > 3.) each blog has all the URLs from it's comment section. > > > For: > 1.) I cannot change all of those to https because they don't all point to > blogmo. I can adjust the ones that do point to blogmo to https but I don't > think these urls are followed often since they're only visible in a user's > profile. > > 2.) In the majority of these cases, these are external links only. Nothing > internal. > > 3.) Nothing to do with the blog itself. > > I will note that while I didn't find any other URL sections (at least that > contained http vs https), there's a LOT of metadata stored in JSON for each > blog. I could spend more time and dig into that metadata if need be.

tanvi, That's correct. None of the items I found are embedded items.

Okay, so it sounds like we will need to take the long road here. I think it is probably fine in that case to simply start with the active blogs and go from there. I will not have time this week and webops has a team meatup week next so we will not realistically be able to work on this for at least two weeks.

I can start knocking these out manually. I would say I can finish this in a few days. However the one site I can't change (and probably the most important) is the main mozilla blog. If you could look at that one.. that would be an immense help. As always many thanks.

(In reply to Ben (:bensternthal) from comment #13) > I can start knocking these out manually. I would say I can finish this in a > few days. > Hey Ben, Have you had a chance to start going through these? Thanks!

Not yet. I will get to them when I can.