FSU Drupal sites now redirect to only use HTTPS.
Why?
HTTPS protects the integrity of your website
Intruders can exploit unprotected communications, they can tamper with communications between your websites and your users' browsers and exploit every unprotected resource that travels between your websites and users including, but not limited to, images, cookies, and scripts.
HTTPS protects the privacy and security of your users
Visitor browsing activities can be used by intruders to make inferences about behaviors or intentions of visitors. Even if a website doesn't contain sensitive information, much can be exploited by an intruder from browsing history on an unsecured website.
HTTPS is the future of the web
An HTTPS website encrypts the communication between the browser and the website server. Encryption allows content to be protected and confidential when crossing between browser and server. When you intentionally share information about yourself on social media, it is your choice and done purposefully. When you use unencrypted websites, you could be virtually handing over your keyboard to a stranger. HTTPS helps as much today as it will tomorrow and seeing the lock icon on your browser that indicates a site uses HTTPS gives the visitors significant protection. Some studies show higher search rankings and faster speeds of websites, which also lead to higher search rankings.
Chrome marks HTTP sites as 'Not secure"
Recently, Google applied a change in Chrome that an HTTP site will be noted as not secure if they have password or credit card fields. Today, an HTTP page where any data is entered or where a page is visited in Incognito mode (due to increased expectations of privacy) will also show as "Not Secure". Google plans to eventually show this warning for all HTTP pages, even when not in Incognito mode.
How do I prepare for the https forced redirect?
If you have an FSU Drupal site, please check the security of your https pages. Some sites will show up with an alert ( 
in Firefox for instance) next to the URL instead of the green padlock. When this happens, look for references to images, css, JavaScript, etc, that use explicit calls using HTTP, rather than HTTPS or just using a relative path. Virtual links on a page will help you avoid these unsecured links.
Links with HTTP in the href will not impact the security of the current page. For example:
<a href="http://www.site.com/">Link</a>
The above example does not represent content that is being incorporated in the current page context. It will not generate mixed content. Link to a non-HTTPS URL in the footer will not generate a mixed content warning on the current page.
Only consider elements which are being 'pulled in' to the context of the current page. Items like CSS, JavaScript files, images, video, flash files, etc. Links should not be considered.
If you are using the FSU Calendar Widget, and it doesn't show on the page, you will need to put an 's' in the https:// URL in the script.
For example -
<script type="text/javascript"
src="https://calendar.fsu.edu/widget/view?schools=fsu&types=89310%2C89311&days=365&num=5&target_blank=1&template=card"></script><!-- block navigation -->
How do I keep the security warning from showing up on my site?
You can keep the warning from showing by making sure all assets on your pages are secured. Want to know which assets on your page are not secure? Please follow one of the links below.
- https://www.whynopadlock.com/index.html
- https://www.jitbit.com/sslcheck/ (Select "No thanks. I do not want to tweet." to gain access)
Read more:
https://developers.google.com/web/fundamentals/security/encrypt-in-transit/why-https
http://mashable.com/2011/05/31/https-web-security/#AaNN_9cG45q8
