Applies to self-hosted versions of:
vBulletin 3; vBulletin 4; vBulletin 5;
Cloud sites have https enabled by default and you do not need to do anything.
This FAQ explains how to convert your vBulletin forum to use secure https (SSL) rather than http, and why you might need to.
Note: This guide contains links to external sites. vBulletin Solutions is not responsible for the content of external links and cannot be held responsible for the accuracy of information contained on them.
WHAT IS HTTPS?
WHAT IS AN HTTPS CERTIFICATE?
When a web browser connects to a webpage via https, the server sends its https certificate to the browser. This certificate contains the public key needed to begin the secure session.
WHY DO I NEED HTTPS?
Starting in January 2017, Google's Chrome browser will begin to mark non-https pages as 'Insecure'. This warning may put off visitors to your site. Other browsers are expected to follow suit in due course.
More details on this can be found HERE
Additionally, Google is now using https as a ranking signal, meaning not having https could harm your site's ranking in Google. More details on this HERE.
HOW IS THE MOBILE APP AFFECTED?
We have updated vBulletin Mobile Suite to version 1.13 to publish apps using HTTPS, to meet Apple's App Transport Security requirement. After Jan. 1, you will not be able to submit updated apps to the iTunes App Store using earlier versions of Mobile Suite. Your current apps are fine and will continue to work with your site; you just won't be able to update them until you use v1.13.
HOW DO I CONVERT MY FORUM TO HTTPS?
You are not tied to buying the certificate from your host, however it is generally the easiest option if you're not well versed in doing this type of thing. If you purcahse one from a third party, you will normally find instructions on your web hosts website for how to perform the installation of the certificate yourself. For example, one hosting company has a guide HERE. There is another guide HERE. Use these guides at your own risk - vBulletin does not endorse and has not tested any of the guides linked to here. If you are unsure - speak to your host, who should be happy to help.
I HAVE MY CERTIFICATE INSTALLED - WHAT NEXT?
vBulletin 3
Go to vBulletin Options > vBulletin Options > Site Name / URL / Contact Details.
Edit 'Forum URL' and add the 's' into the URL.
For example, if your URL is http://www.contoso.com/forum, change it to https://www.contoso.com/forum
Then go to Settings > vBulletin Options > vBulletin Options > Server Settings & Optimization Options > Use Remote YUI
Set this to Google.
vBulletin 4
Go to Settings > Options > Site Name / URL / Contact Details.
Edit 'Forum URL' and add the 's' into the URL.
For example, if your URL is http://www.contoso.com/forum, change it to https://www.contoso.com/forum
Then go to Settings > Options > Server Settings & Optimization Options > Use Remote YUI
Set this to Google.
vBulletin 5
Go to vBulletin Options > vBulletin Options > Site URLs and Routing.
Edit these two settings: 'vBulletin URL'; 'Core URL' and add the 's' into the URL.
For example, if your URL is http://www.contoso.com/forum, change it to https://www.contoso.com/forum
NOTE: Do not remove the word 'core' at the end of the core URL. You will break your site!
Then go to Settings > Options > Server Settings & Optimization Options > Use Remote jQuery
Set this to Google.
The key to all three vBulletin versions is that all you do in the URL settings is change http to https. Do not alter any other part of the URL.
Once you have changed these settings, go to AdminCP > Maintenance > General Update Tools, and rebuild the styles. (In vB3 this is AdminCP > Maintenance > Update Counters). Leave the default settings and just run this update tool.
There is code in the .htaccess that ships with vBulletin 5 to redirect users from http to https. If you wish to utilize this, you will need to uncomment these lines:
#RewriteCond %{HTTPS} !=on #RewriteRule .* https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
ANYTHING ELSE?
Again, in most cases, the simplest way to arrange this is to ask your host to configure it for you. They shouldn't charge for doing this, and it won't take them very long.
If you'd rather do it yourself, it involves playing about with special files used by different types of server software - For instance, a server running 'Apache' will use an '.htaccess' file, whereas a server running IIS will use a 'web.config' file. If you don't know which server software your server is running, speak to your host. GoDaddy have a useful guide to making these changes HERE. However, these files can be quite tricky to work with, and an incorrect entry will break your site. It's much simpler to get your host to do it!
THAT'S IT!
You may run into issues with 'embedded images', where people have embedded external images or videos from third party sites into your posts, where those sites are or were not using https. These will trigger what is called a 'Mixed Content Warning' in the padlock area of the browser. In practice, what this means is that such embedded images or videos will not show and users may just see a blank space. You should aim to convert these images to attachments, subject to copyright, though this will be a manual task and can be fairly arduous if there are lots of them. Alternatively you can manually edit the embedded URL to change it to https. This will work for major sites like YouTube, but on some sites it may not work if https is not available. There are some third party add-ons that can help with this problem such as THIS ONE, however vBulletin cannot provide official support for third party code.
If you have any questions regarding this guide, please post in the correct support forum for your version.