Sucuri alert : Website in http instead of https

Hello @cmyla , I investigated and found this:

• The value for the “Website” is added to the mail here [1]
• Variable $website [2] is set using function self::getDomain() [3]
• This function uses get_site_url() [4] which is provided by WordPress
• WordPress uses is_ssl() [5] to choose either “http” or “https”

The conclusion is, either WordPress is broken or your website is mis-configured, because the HTTP protocol in the website URL is selected using WordPress‘ own logic which basically checks if the web server is setting the correct global variables via $_SERVER, more specifically $_SERVER['HTTPS']. Please refer to the WordPress documentation to know how that function checks for the availability of TLS.

If your web server is setting the correct variables, a possible explanation for this issue is that your website is not enforcing HTTPS, even though it’s configured. I suggest you to contact your hosting provider, and send them this information so they can provide you with a solution.

Because this is not an error with the plugin, I will mark this ticket as resolved. Let me know if you need more information.

[1] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/ceaf0d2e4ff46c4ec32a2c069f2138643809e52e/src/mail.lib.php#L212
[2] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/ceaf0d2e4ff46c4ec32a2c069f2138643809e52e/src/mail.lib.php#L173
[3] https://github.com/Sucuri/sucuri-wordpress-plugin/blob/ceaf0d2e4ff46c4ec32a2c069f2138643809e52e/src/base.lib.php#L551-L567
[4] https://developer.www.ads-software.com/reference/functions/get_site_url/
[5] https://developer.www.ads-software.com/reference/functions/is_ssl/