Follow-up question for Sandro and Donmj - Secure Server while on HubSpot Email marketing

Hi there,

I previously reached out with an error I had with HubSpot Email Domain @domjh
which was fixed by changing the DNS Proxy Status to “Proxied” to “DNS only” see old thread here: HubSpot Email Domain - #2 by domjh

there was a comment from @sandro

Blockquote @user6708, you’ll also want to secure your server, as you currently have no SSL configuration whatsoever on your server, meaning you still have an insecure site.

I was very busy for the last month, and just noticed now that the our website has “not secure” on the padlock.

can you please help clarify this to me?

does this mean that every time I need to send marketing emails I would have to disable Cloudflare? and does that disable the security of the website when I do that?

what can I do do enable them both at the same time?

I would appreciate your help and clarifications on this topic.

looking forward to your response!

Greetings again,

I just noticed that there are pages that have a secure padlock on the website and there are some that don’t like this one:

How can I prevent this from happening to our pages?

Possible issue due to the:

  1. Flexible SSL issue
  2. HTTP content (like images) being loaded and served over HTTPS connection (Website) - possible Mixed content errors / Redirection loops (related to Flexible SSL)

Hm, I do not see it in corelation, but why not having fully secured Website and content even while sending e-mail newsletter which should also contain resources being served via secured connection (HTTPS)?

Solution (if already not being posted):

Here is a way to re-check if you correctly setup the SSL for your domain with Cloudflare:

In case you do not have an SSL certificate, you can use Cloudflare SSL, if so, kindly make sure you follow the instructions as follows on the below article to setup an SSL certificate using Cloudflare CA Origin Certificate:

Last but not least, kindly have a look here for more information regarding correct SSL settings:

After all, kindly enable Always Use HTTPS and Automatic HTTPS Rewrite option just in case and keep the :orange: cloud on yourdomain.com (proxied), to do so kindly navigate to the SSL tab → Edge Certificates and find both of the sections there.

In short, Always Use HTTPS option will redirect all the HTTP requests for your Website to HTTPS. The Automatic HTTPS Rewrites option changes the URLs on your Website to be HTTPS if Cloudflare knows the fact that the destination actually works over and supports HTTPS.

https://support.cloudflare.com/hc/en-us/articles/227227647-Understanding-Automatic-HTTPS-Rewrites

1 Like

Thank you for all these information. I will look into them one by one.

The reason why I placed it in flexible was because our domain host “bizango” doesn’t give us a setting where we can manually upload the SSL certificate from Cloudflare they would have to do it from their end. but they told me that they didn’t need that and that we just had to turn the setting to Flexible and it did show the padlock sign when I enabled it.

I see they flunked Security 101.

1 Like

I am really sorry to hear that, but unfortunately this one is a really bad advice for you as their customer and even for us and others as end-users/consumers of your Website nowadays.

Even for them as a hosting provider, I mean, do they actually have some security in their mind? Could be questioned …

2 Likes

I was under the impression that was really it, because to me it seemed to already work. This was the first time I learned about SSL and web security. I was doing a lot of research but couldn’t really figure out the right way.

2 Likes

Thank you for helping me with this. I really appreciate it. I unfortunately don’t have enough time to work on it today but should get a fresh start tomorrow.

1 Like

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.