Securing Custom Domain Github Pages

I have (finally) decided to get that shiny locked padlock icon for all my sites running as Github Pages. Github released HTTPS for Github Pages in June of this year. However, this feature does not support Github Pages using custom domains.

Securing your site with Cloudflare

I chose to use Cloudflare because offers a free tier for SSL. Note that the certificate issued to you will be from \*.cloudflaressl.com and is not considered full SSL because the connection from CloudFlare and Github Pages may not be secure. However, your site will behave as if it had full SSL and will offer security against attacks such as those on unsecured networks.

1. Make an account / Log into CloudFlare
2. Add your site(s), select the “Free Website” plan
3. Make sure all the records autogenerated by CloudFlare matches the records you have with your domain registrar
4. Update the nameservers to point at the ones provided from CloudFlare with your domain registrar
5. Your site(s) should be served over https within 1-48 hours

Other considerations

• Changing your site to HTTPS is similiar to moving to a brand new URL, so it is important to consider the effect it will have on SEO. In 2014, Google announced that switching to HTTP will give a minor ranking boost. Google also has a guide for URL changes.
• Redirecting your users from HTTP to HTTPS can be done with Cloudflare with page rules or with plain javascript.

var host = “<yourwebsite>.com”;
if ((host == window.location.host) && (window.location.protocol != “https:”))
window.location.protocol = “https”;

• Make sure to fix mix content if you have any.
• That’s about all I had to do to make sure the transition to HTTPS was smooth. For bigger sites, more things would need to be considered such as robots.txt, sitemaps, external links (social media), analytics, etc. Do your research!