Conversation
supportI just installed some certificates from the Let’s Encrypt initiative and switched my games blog among others over to https-only. I have weeded out all other non-encrypted sources (decorative widget images and the like) but I still get a ‘partially encrypted’ message from Firefox when I visit. I believe that the the game icons that the Advanced Steam Widget loads are the cause of this, as they have http and not https addresses when I go through the page’s source code. You can see for yourself at https://games.brokkr.net Is this correct? And if so, is it possible to have the plugin use https when getting ressources? https://wordpress.org/plugins/advanced-steam-widget/
D’uh. I could of course just test my theory by removing the widget. And yes, that does remove the last unencrypted content from the page which is now given the all-encrypted padlock sign by Firefox. So the question remains: Is it possible to get the ressources over https (i.e. are they availabe that way) and is it something that you might consider for the plugin?
Well, there are secure versions of the Steam images, but they aren’t revealed in the data that is retrieved for the widget. I’d have to hard-code in a server address that is subject to change, and I’m not sure I want to do that. Of course, it’s of little use to download a few Steam icons as encrypted, but I understand the symbolic purpose of it. If this feature is important to anyone else, leave a reply, and I might consider adding it.
As you rightly point out the lack of encryption off a few images aren’t a big deal. It’s just annoying that it causes the whole page to be termed ‘un-safe’. I like the plugin – and thank you for your work – but that annoyance probably weighs heavier. But I understand your reluctance to make such changes. I’m thinking that caching the images locally and then serving them from there could circumvent the issue but I suspect that that is outside the scope of a WordPress plugin – or maybe PHP in general – apart from possible copyright issues.
D’uh. I could of course just test my theory by removing the widget. And yes, that does remove the last unencrypted content from the page which is now given the all-encrypted padlock sign by Firefox. So the question remains: Is it possible to get the ressources over https (i.e. are they availabe that way) and is it something that you might consider for the plugin?
Well, there are secure versions of the Steam images, but they aren’t revealed in the data that is retrieved for the widget. I’d have to hard-code in a server address that is subject to change, and I’m not sure I want to do that. Of course, it’s of little use to download a few Steam icons as encrypted, but I understand the symbolic purpose of it. If this feature is important to anyone else, leave a reply, and I might consider adding it.
As you rightly point out the lack of encryption off a few images aren’t a big deal. It’s just annoying that it causes the whole page to be termed ‘un-safe’. I like the plugin – and thank you for your work – but that annoyance probably weighs heavier. But I understand your reluctance to make such changes. I’m thinking that caching the images locally and then serving them from there could circumvent the issue but I suspect that that is outside the scope of a WordPress plugin – or maybe PHP in general – apart from possible copyright issues.