Securing access to Wikimedia sites with HTTPS by default
This is a great move and has inspired me to think of how I can do this for the sites I run.<p>The problem I have is that I run forums which accept user generated content, and the links in the content are then parsed and embeds are put in.<p>For example, YouTube links have the embedded video put below to the link.<p>YouTube support https, but a lot of smaller sites that offer really useful tools don't yet support https. An example is something like <a href="http://www.bikely.com" rel="nofollow">http://www.bikely.com</a> which does not support https at all, and yet the embedded maps are common enough on the cycling forums I run.<p>I cannot just proxy via a https domain as these sites usually have JavaScript that require permission to talk to their own domains.<p>I've decided to start emailing all of the 3rd parties to ask that they add https to their site.<p>Almost 40% of my traffic is now over https, and it's harder to increase that as every time I try to I receive support complaints about mixed-content warnings, missing content, etc.<p>If you also run a site that has embeds in user generated content, please consider emailing the 3rd parties and explaining why they should move to https.<p>There are only a few things holding back a lot of sites and it's no longer the cost of a cert and SSL termination:<p>1) Embedded widgets that are http only today<p>2) Advert widgets/scripts that are http only today<p>Those things hold the vast majority of news sites back too. I even checked the Guardian yesterday and no https available. The only news site that was https was The Verge, but I'm not sure tech news is really news.