I've been meaning for a long time to secure all my websites with SSL and I thought it would be very complicated, but it turns out Bluehost actually offers this service directly, you. You just login to bluehost.com and then go to:
- WordPress Tools. You will see that you have the ability to make changes there. Bluehost is using a tool that let's it change wp-login to a nice format.
- Then go to Security and click enable SSL and this got me I'm not eligible for one site and for others I get an "unknown error", but for some I can enable SSL. It seems that this page is pretty buggy.
So back to google and now I am on a different page that explains something that does exactly the same and does seem to work
- Go to Cpanel at Bluehost and find the SSL widget page and look for your domain. Note this only worked for me with WordPress domains.
- Click on the big "Free for WordPress" button in the middle then choose install. Now it says sit back and relax but I'm still not quite sure what happens next, but at some point "https://tongfamily.com" should work.
- It says it takes hours, but for me it was about an hour, you get an email to the bluest administrator saying order started and then order complete. And suddenly, tongfamily.com is https enabled.
- Now you have to do a big edit on your site changing all references to "https://tongfamily.com" to "https://tongfamily.com", WordPress makes that pretty easy with search and replace.
- As an aside this free SSL expires every three months and it automatically renews. Another aside is some say on Stackoverflow that you still want to get a real SSL certificate that does validation, because there is no ownership check here, so someone could hack in and take over your domains, maybe that will be the next step for me, but in the meantime, this is incrementally better.
Right now things are a little weird, if you try to type "https://tongfamily.com" then you get an impersonation message and get directed to some random site on the shared host we are using. Pretty broken, let's see if this fixes it.
Otherwise, I'm off to look at different hosters again.