# HTTPS for Discourse

**URL:** <https://discourse.beets.io/t/https-for-discourse/70>\
**Category:** Site Feedback\
**Created:** [April 18, 2017, 8:13pm UTC](https://discourse.beets.io/t/https-for-discourse/70 "2017-04-18T20:13:29Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Freso](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.beets.io/freso/32/21_2.png) [@Freso](https://discourse.beets.io/u/Freso)\
**Post date:** [April 18, 2017, 8:13pm UTC](https://discourse.beets.io/t/https-for-discourse/70/1 "2017-04-18T20:13:29Z")

</div>

Would it be possible to set up HTTPS for these forum/discussion board? I don’t like using JavaScript heavy sites over plain HTTP, esp. not when it carries authentication information too. 🙈

---

<div class="post-metadata">

**Author:** ![adrian](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.beets.io/adrian/32/4_2.png) [@adrian](https://discourse.beets.io/u/adrian)\
**Post date:** [April 19, 2017, 2:06am UTC](https://discourse.beets.io/t/https-for-discourse/70/2 "2017-04-19T02:06:27Z")

</div>

Hmm, yes, it is weird that this is running unencrypted. I can’t find an obvious way to turn on TLS in the setting here… the site is hosted thanks to a generous donation from the Discourse people, so I don’t have direct control over the server.

Would anyone be willing to volunteer to email the Discourse people and ask whether it’s possible to turn on security for hosted sites?

---

<div class="post-metadata">

**Author:** ![igwb](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.beets.io/igwb/32/29_2.png) [@igwb](https://discourse.beets.io/u/igwb)\
**Post date:** [April 27, 2017, 7:04pm UTC](https://discourse.beets.io/t/https-for-discourse/70/3 "2017-04-27T19:04:39Z")

</div>

Has there been any previous communication with the “discourse people” that I could refer to when contacting them?

---

<div class="post-metadata">

**Author:** ![adrian](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.beets.io/adrian/32/4_2.png) [@adrian](https://discourse.beets.io/u/adrian)\
**Post date:** [April 28, 2017, 2:13am UTC](https://discourse.beets.io/t/https-for-discourse/70/4 "2017-04-28T02:13:36Z")

</div>

Nothing too personal, but we did get a form letter when our request for an OSS hosted forum was approved. I’ll send you a private message with that email address!

---

<div class="post-metadata">

**Author:** ![JDLH](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@JDLH](https://discourse.beets.io/u/JDLH)\
**Post date:** [May 29, 2017, 5:55am UTC](https://discourse.beets.io/t/https-for-discourse/70/5 "2017-05-29T05:55:48Z")

</div>

Me too — I would rather use this site over https rather than http. My browser pointed out that when I created this account just now, my password was being sent in the clear to the server.

How did it go, contacting the Discourse people and asking them to turn on https?

---

<div class="post-metadata">

**Author:** ![adrian](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.beets.io/adrian/32/4_2.png) [@adrian](https://discourse.beets.io/u/adrian)\
**Post date:** [May 30, 2017, 1:51am UTC](https://discourse.beets.io/t/https-for-discourse/70/6 "2017-05-30T01:51:09Z")

</div>

I just emailed them, and they immediately turned on SSL! We should be good to go.

---

<div class="post-metadata">

**Author:** ![JDLH](https://avatars.discourse-cdn.com/v4/letter/j/77aa72/32.png) [@JDLH](https://discourse.beets.io/u/JDLH)\
**Post date:** [May 30, 2017, 6:37am UTC](https://discourse.beets.io/t/https-for-discourse/70/7 "2017-05-30T06:37:57Z")

</div>

It works for me now! I can log in from an https: URL. When I connect via an insecure, http: URL, the site transfers me to the corresponding secure, https: URL.  
Thank you, @adrian.