Securing access to Wikimedia sites with HTTPS by default
This is a great move and has inspired me to think of how I can do this for the sites I run.The problem I have is that I run forums which accept user generated content, and the links in the content are then parsed and embeds are put in.For example, YouTube links have the embedded video put below to the link.YouTube support https, but a lot of smaller sites that offer really useful tools don't yet support https. An example is something like http://www.bikely.com which does not support https at all, and yet the embedded maps are common enough on the cycling forums I run.I cannot just proxy via a https domain as these sites usually have JavaScript that require permission to talk to their own domains.I've decided to start emailing all of the 3rd parties to ask that they add https to their site.Almost 40% of my traffic is now over https, and it's harder to increase that as every time I try to I receive support complaints about mixed-content warnings, missing content, etc.If you also run a site that has embeds in user generated content, please consider emailing the 3rd parties and explaining why they should move to https.There are only a few things holding back a lot of sites and it's no longer the cost of a cert and SSL termination:1) Embedded widgets that are http only today2) Advert widgets/scripts that are http only todayThose things hold the vast majority of news sites back too. I even checked the Guardian yesterday and no https available. The only news site that was https was The Verge, but I'm not sure tech news is really news.