TLS and HTTPS Fundamentals

TLS (Transport Layer Security) is the cryptographic protocol that secures communications over computer networks. When applied to HTTP, it becomes HTTPS, ensuring that data transmitted between browsers and servers remains private and integral. Modern web browsers actively warn users when accessing sites without HTTPS, making it essential for any MyBB forum handling user data.

TLS certificates, issued by Certificate Authorities (CAs), enable asymmetric encryption. Browsers request the public key to encrypt data, which can only be decrypted by the server's private key. This process establishes a secure connection, even on public networks like Wi-Fi hotspots. LiteSpeed Web Server, combined with Let's Encrypt certificates, provides an efficient solution for MyBB forums.

Configuring TLS Certificates

For MyBB forums hosted on LiteSpeed Web Server, obtaining and installing a TLS certificate is straightforward. Use the following steps to configure Let's Encrypt:

  1. Ensure your domain's DNS records are correctly configured.
  2. Install the CertBot utility: sudo yum install certbot.
  3. Obtain the certificate: sudo certbot certonly --webroot -w /home/user/public_html -d forum.example.com.
  4. Configure LiteSpeed to use the certificate by navigating to the WebAdmin console and updating the SSL settings.

If using a reverse proxy like Cloudflare, ensure both the proxy-to-client and proxy-to-origin connections use HTTPS. Cloudflare's Origin CA certificates or Let's Encrypt certificates can secure the origin server.

Protocol Redirection and Mixed Content

Once HTTPS is configured, redirect all HTTP traffic to HTTPS. Add the following rules to your .htaccess file:

RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

For reverse proxies, check the X-Forwarded-Proto header:

RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Mixed content occurs when HTTPS pages include HTTP resources like images or scripts. MyBB's Secure Content plugin helps mitigate this by blocking non-HTTPS avatars and MyCode images. Update your theme's templates and CSS files to use HTTPS URLs. Use the Search/Replace utility in MyBB's AdminCP to replace all instances of http:// with https://.

Enhance your MyBB forum's security by implementing HTTP headers:

  • Strict-Transport-Security: max-age=31536000; includeSubDomains; preload prevents HTTP downgrades.
  • Content-Security-Policy: upgrade-insecure-requests; default-src https: data: 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; base-uri 'self' blocks unsecured elements.
  • X-Frame-Options: deny prevents clickjacking.
  • X-XSS-Protection: 1; mode=block enables browser XSS filtering.
  • X-Content-Type-Options: nosniff ensures correct MIME type interpretation.

Set the Secure Cookie Flag in MyBB's AdminCP under Configuration → Site Details to ensure cookies are only sent over HTTPS. This prevents session hijacking on insecure connections.