tagDiv Composer broken on HTTPS: Mixed Content warning in Chrome

Hi there,

I just installed the Newspaper 8 (v8.1, downloaded today), and the tagDiv Composer editor does not load the page within the iframe because of mixed content warnings. My website is hosted on WPengine (which uses HTTPS) but the tagDiv Composer plugin doesn’t seem to recognize that the URL it needs to load in the iframe also needs to be HTTPS.

Is there a setting somewhere that I’m missing that would turn on HTTPS for this, or is this legitimately a bug that needs to be fixed? I’m sure I could dive into the code myself to resolve but that’s not in my client’s budget, it wouldn’t be a maintainable fix, and I’ve got 6 months of support from you guys.

My stop-gap solution is just using Chrome dev tools to change the protocol to HTTPS, which seems to completely resolve the issue, it’s just a super pain to do that every time and… ultimately, my client may end up making these kinds of changes in the future and that’s not something that I would expect them to do.

Any help is appreciated. Thanks,
-Nick

We don’t have this issue on any of our sites, so dunno.

You might ensure you have your site set as https in the WP admin settings and/or in your wp-config.php file.

Likely useful to use console in Chrome to see what the actual error *is* and share that here?

( I don’t work here. )

Simion,

Thanks for your reply. I might have to hold off for the moment. I have a commitment to a client to start customizing the template a little bit so they can review it (by end of day today), so I wouldn’t want two people in the backend at the same time, or someone futzing with stuff when I know a client will be looking at the site.

If you’re confident that you could jump in there and investigate (and potentially resolve) within the next two or three hours, I’d be happy to provide those credentials. Otherwise I may have to hold off for a day or two.

Let me know. Thanks!

Thanks Simion. I’ve just sent that email.

Some additional information. Since we host with WP engine, we are provided two different environments to work with (production and staging). Both are available for you to troubleshoot with and use the same access credentials. I’d recommend troubleshooting via the staging environment, as that doesn’t use a forced HTTP -> HTTPS redirect for the WP dashboard, as the production environment does.

You’ll notice that using the staging environment, you can switch between HTTP and HTTPS at will and the tagDiv Composer will work, and not work, respectively.

We’ll stay out of the website for now, so you can do your thing. Please let me know what you find out, and if you find a fix, please let me know what it was. I’ve created backups of each environment moments ago so I can restore them following your troubleshooting process, if need be.

Thanks very much!

I just thought I’d follow-up with the solution to my problem.

For context, I host my WordPress website on WP engine, which takes many precautions to prevent hacking and make WordPress more secure. One of the things it does is force HTTPS in the admin dashboard, even if the WordPress Address (URL) and Site Address (URL) options are set to HTTP URLs.

Unfortunately, the tagDiv Composer plugin loads the iframed version of the site (in the whole drag-and-drop editor interface) via the protocol specified via those WordPress options (found under Settings -> General), and not via the protocol that’s being used to access the dashboard.

Changing the protocol in both of those WordPress settings appears to have resolved the issue, but it seems that I’ll likely need to purchase an SSL certificate for the front-end of my website when it eventually goes live, so the change I made to those options doesn’t produce insecure content warnings.

I’ve asked tagDiv to just modify their plugin slightly to load the iframe via the same protocol as the parent (of the iframe) page, as that would resolve the issue in code, rather than having to do so via a particular setup of options (which are stored in the database).

As of now, I haven’t received a response on that, so who knows if that change will be implemented.

[EDIT] I also realized that once my site goes live at the real domain (and not a subdomain of wpengine.com), the admin interface will revert back to HTTP (unless I purchase and implement an SSL certificate, which could be used on the front and back end anyhow), so this is only really a problem during development, but that’s when I will be doing most of the work in the tagDiv Composer plugin anyway.

• This reply was modified 8 years by airdailyx.

Note most web hosts now provide free SSL certs to enable https/TLS secure connections; using ‘Let’s Encrypt’ — so all sites should be https now as part of the ‘https everywhere’ movement.

Chrome has started to ‘warn’ site visitors about unsafe sites not loading via https; and any online form/login will get large ‘not safe notice’ as of October 2017 —

so ‘best practices’ now would to be always plan for https everywhere as the standard.

Chris, you’re right on the money with that one. I just checked and it appears that WP engine offers free SSL certs via Let’s Encrypt.

Thanks for the heads up!