Why do unsafe site warning appear when people access my website?

• 

  hmaustralasia · Member · Apr 25, 2014 at 3:33 am

  • Copy link
  • Add topic to favorites

  I’ve had reports that people attempting to access the site are seeing an ‘unsafe site’ warning from their browsers. Do you know what in the website might be causing this?

  The blog I need help with is: (visible only to logged in users)

• 

  apokalyptik · Staff · Apr 28, 2014 at 10:13 pm

  • Copy link

  Hello,

  to help me figure out how to best answer would you mind sharing how are these people attempting to access the site (mobile, from a link, a bookmark, an app, etc?) Also would it be possible to make sure the issue is still happening (we had a semi-related problem a while back which should be fixed now, so this may just no longer be a problem)?

  Cheers!
  DK

• 

  hmaustralasia · Member · May 13, 2014 at 12:03 am

  • Copy link

  Apologies for the delay in replying. The SSL issue emerges when the site is access from a link such as this:

  https://hmaustralasia.org/2014/04/15/historical-materialism-australasia-2014-states-social-reproduction-capital/

  (tested on Safari and Chrome).

  The text we see is:

  You attempted to reach hmaustralasia.org, but instead you actually reached a server identifying itself as *.wordpress.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of hmaustralasia.org.

• 

  rachelmcr · Member · May 14, 2014 at 4:35 pm

  • Copy link

  Hi there,

  This issue pops up because the URL you’re using begins with https:// instead of http:// (without the “s”). You’ll need to use this URL instead: http://hmaustralasia.org/

  When you connect to your WordPress.com dashboard over an HTTPS connection, we use an SSL certificate to encrypt your connection. However, we don’t support HTTPS connections for blogs with mapped domains (like your domain hmaustralasia.org). SSL certificates need to be signed to a specific domain, and we can’t provide certificates for every mapped domain, so our certificate is signed for WordPress.com.

  When you connect to your domain via HTTPS but your security software sees a certificate signed to http://wordpress.com/ it’s alerting you that WordPress.com may be intercepting your connection. That’s actually fine, since your site is hosted by WordPress.com, but your browser doesn’t know that — so it sends that alert.

  Please let me know if you have any questions about that. :)

• 

  hmaustralasia · Member · May 22, 2014 at 11:05 am

  • Copy link

  Thanks for a clear and cogent answer. Very helpful.