CharlieHamu

Yes, thanks. I haven’t yet had a chance to break it again.

Hopefully this coming weekend. At the very least I’ll make a list of all the .htaccess directives that I removed, so that we can know that it was one or more of them that caused the problem.

At any rate, in addition to your usual directions about incognito + no other plugins + default theme, you can add + stock WordPress .htaccess.

There was a lot of stuff in my .htaccess file, including but not limited to:

# BEGIN	WP 2.5 image upload	http error fix
<IfModule mod_security.c>
<Files async-upload.php>
SecFilterEngine	Off
SecFilterScanPOST Off
</Files>
</IfModule>
# END WP 2.5 image upload http error fix

And:

#	Caching.
#		Server is providing both Last-Modified and ETag, so remove one.
Header unset ETag
FileETag none
#		Server sets both Cache-Control and Expires, so remove one.
Header unset Expires
#		1 year.
<FilesMatch	"\.(ico|pdf|flv|jpg|jpeg|png|gif|js|swf)$">
Header set Cache-Control "max-age=31556926, public"
</FilesMatch>

I reverted to the minimum, only this:

# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

The http -> https rewriting is being handled by the DreamHost Panel only.

Later, I may figure out exactly which parts of my complicated .htaccess file were causing which problems.

But now I’m getting this again when I click to connect to my Google account:

Welcome to Site Kit! Let’s get you set up
invalid parameter: ‘site_id’

Ah, but that was resolved with incognito + troubleshooting mode. It’s all working now. If you leave this ticket open for a day or two, I’ll report the exact offending lines from my .htaccess file.

Thanks!

• This reply was modified 3 years, 2 months ago by CharlieHamu.

Your direction to keep examining how http -> https redirects were handled differently between the site that works and the site that doesn’t work led me to realize that my .htaccess file had a great many redirects back to http for individual pages and sets of pages, even though there was an initial redirect to https.

Some of the redirects were sufficiently general that they could have messed up the Site Kit plug-in’s ability to reference its own files securely, which seemed to be what the console errors were saying. And that explanation would also possibly make sense of why it worked when my Site URL matched my WordPress URL: it might have been provoking fewer of these redirects.

So I fixed all of that and progressed to a new error:

Your site may not be ready for Site Kit
Looks like you may be using a caching plugin which could interfere with setup. Please deactivate any caching plugins before setting up Site Kit. You may reactivate them once setup has been completed.

I have my cache off and emptied, but I haven’t tried incognito or troubleshooting mode yet. This, by the way, is why I’m not really thinking it’s the Contact Form 7 plug-in, because that would be disabled in troubleshooting mode anyway. But I will investigate it and fix any http that’s still there.

Anyway, I still have several things to try, including reverting to a minimal .htaccess file. (Even the http -> https redirection is handled DreamHost, in some higher-level .htaccess file or reasonable facsimile, so I don’t need that redirection in my handcrafted file. It’s not in the .htaccess file for the WordPress site that works with Site Kit.)

I post again in a day or two as soon as I either resolve the situation or hit the next impasse.

• This reply was modified 3 years, 2 months ago by CharlieHamu.
• This reply was modified 3 years, 2 months ago by CharlieHamu.
• This reply was modified 3 years, 2 months ago by CharlieHamu.
• This reply was modified 3 years, 2 months ago by CharlieHamu.

1. Data now shows.

2. ?

3. ?

1. Using another WordPress site on the same DreamHost shared hosting plan, Site Kit installed without problems. No data to show yet, but no complaints about not being ready and no complaints about being offline. Note that this was a DreamHost one-button install of “DreamPress” as I recall, done earlier this year. And note that Site URL and WordPress URL match (both root). And note that when I made the two match for my site (both /wordpress/ subdirectory) it also worked … but messed up the URLs and didn’t actually have data to show yet.

2. [site_id above] ?

3. [console errors above] ?

• This reply was modified 3 years, 2 months ago by CharlieHamu.

1. I will try a clean WordPress install on a different domain.

2. But in the meanwhile, I’m not sure what you reset on your side (I didn’t even know there was a “your side”), but that’s led to the site_id problem preventing connection entirely. What’s that all about?

3. And insecure resource on my widgets page https://danforthgreens.ca/wp-json/google-site-kit/v1/core/site/data/developer-plugin/?_locale=user is surely not related to the location of the MySQL database. (It’s not in the top-level code if I view source, so I guess its buried in included JavaScript somewhere.) Where is that coming from?

Reinstalled WordPress 5.8.1.

Still getting the same:

Your site may not be ready…

Still getting the quite new:

Welcome to Site Kit! Let’s get you set up
invalid parameter: ‘site_id’

You can get this error, too, at this URL:

https://sitekit.withgoogle.com/site-management/setup/?scope=openid%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fsiteverification%20https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fwebmasters&supports=credentials_retrieval%20short_verification_token%20user_input_flow%20file_verification&nonce=b02ba1172e&site_id=X7roq2iH6tuewoc8SP2wwC-VVUBFnzkqa2yozTDJosYyk.apps.sitekit.withgoogle.com&user_roles=administrator&application_name=wordpress%2Fgoogle-site-kit%2F1.40.0&hl=en_US

• This reply was modified 3 years, 2 months ago by CharlieHamu.

Not quite believing that Google Site Kit itself was the original source of mixed content, I uninstalled the on-the-fly http/httos fixer (keeping whatever permanent fixes it had made), uninstalled Site Kit complete (verified that the directory was gone) reinstalled, and immediately got these errors on the widgets page itself:

Visible at the top of the widgets page:

Congratulations, the Site Kit plugin is now activated.
Your site may not be ready for Site Kit
Looks like this may be a staging environment. If so, you’ll need to install a helper plugin and verify your production site in Search Console

Console errors for that page:

Mixed Content: The page at ‘https://danforthgreens.ca/wordpress/wp-admin/plugins.php?plugin_status=all&paged=1&s’ was loaded over HTTPS, but requested an insecure resource ‘https://danforthgreens.ca/wp-json/google-site-kit/v1/core/site/data/health-checks/?_locale=user’. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:GET datapoint:health-checks type:core identifier:site error:”You are probably offline.”
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1
plugins.php:1 Mixed Content: The page at ‘https://danforthgreens.ca/wordpress/wp-admin/plugins.php?plugin_status=all&paged=1&s’ was loaded over HTTPS, but requested an insecure resource ‘https://danforthgreens.ca/wp-json/google-site-kit/v1/core/site/data/developer-plugin/?_locale=user’. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:GET datapoint:developer-plugin type:core identifier:site error:”You are probably offline.”
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1

• This reply was modified 3 years, 2 months ago by CharlieHamu.

1. Browser console errors.

Lots of good stuff (in this case from non-incognito, non-troubleshooting mode):

Mixed Content: The page at 'https://danforthgreens.ca/wordpress/wp-admin/admin.php?page=googlesitekit-dashboard&notification=reset_success' was loaded over HTTPS, but requested an insecure resource 'https://danforthgreens.ca/wp-json/google-site-kit/v1/core/site/data/notifications/?_locale=user'. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:GET datapoint:notifications type:core identifier:site error:"You are probably offline."
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1
admin.php:1 Mixed Content: The page at 'https://danforthgreens.ca/wordpress/wp-admin/admin.php?page=googlesitekit-dashboard&notification=reset_success' was loaded over HTTPS, but requested an insecure resource 'https://danforthgreens.ca/wp-json/google-site-kit/v1/modules/search-console/data/searchanalytics/?dimensions=date&startDate=2021-07-16&endDate=2021-09-09&_locale=user'. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:GET datapoint:searchanalytics type:modules identifier:search-console error:"You are probably offline."
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1
admin.php:1 Mixed Content: The page at 'https://danforthgreens.ca/wordpress/wp-admin/admin.php?page=googlesitekit-dashboard&notification=reset_success' was loaded over HTTPS, but requested an insecure resource 'https://danforthgreens.ca/wp-json/google-site-kit/v1/modules/search-console/data/searchanalytics/?startDate=2021-08-13&endDate=2021-09-09&dimensions=query&limit=10&_locale=user'. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:GET datapoint:searchanalytics type:modules identifier:search-console error:"You are probably offline."
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1
admin.php:1 Mixed Content: The page at 'https://danforthgreens.ca/wordpress/wp-admin/admin.php?page=googlesitekit-dashboard&notification=reset_success' was loaded over HTTPS, but requested an insecure resource 'https://danforthgreens.ca/wp-json/google-site-kit/v1/core/user/data/survey-trigger/?_locale=user'. This request has been blocked; the content must be served over HTTPS.
googlesitekit-api.8864d1fded0aab37a78b.js:1 Google Site Kit API Error method:POST datapoint:survey-trigger type:core identifier:user error:"You are probably offline."
(anonymous) @ googlesitekit-api.8864d1fded0aab37a78b.js:1

2. Hosting provider:

DreamHost shared server with WordPress self-insalled 15 years ago and auto-updated since.

Wait! I recall noting a few weeks ago, in my danforthgreens.ca/wordpress/wp-config.php:
define('DB_HOST', 'mysql.hamufamu.org'); // TODO: move this! cdhh

HamuFamu.org is also DreamHost, in an adjoining directory. But obviously a different domain and may have its own SSL issues. But again, I want to mention that when I changed my home URL to match my WordPress directory URL, the problem went away.

3. Retry after reset on service side:

Quite new results in one respect. When I tried to connect after a reset in incognito troubleshooting mode, I got a bad parameter error that prevented me from completing, shown here: https://imgur.com/a/ESKRX6y

• This reply was modified 3 years, 2 months ago by CharlieHamu.

Tried again on another device as well.

I believe all mixed content issues are resolved. Do you have any indication otherwise?

My problems remain. Thanks!

https://www.jitbit.com/sslcheck/ finds no mixed content now, but doesn’t scan every page.

https://www.missingpadlock.com/ is scanning now.

Incognito troubleshooting mode Site Kit reset still has the same result.

I manually fixed any references to http in image resources, Javascript includes, etc, in my theme’s PHP and CSS. I installed a mixed-content-fixing plug-in. I do have a nice lock icon, but I had that before.

I used https://www.jitbit.com/sslcheck/ to find:
SSL Issues:
https://danforthgreens.ca/category/principles/non-violence/
https://danforthgreens.ca/category/news/
https://danforthgreens.ca/category/videos/
https://danforthgreens.ca/category/green-paperclip/page/2/
https://danforthgreens.ca/category/portlands-energy-centre/page/2/
https://danforthgreens.ca/further-action-against-the-keystone-xl-pipeline/

I’ll look at these next. Can this really be the source of the trouble?

A great many screenshots: https://imgur.com/a/9RQlxTS

• This reply was modified 3 years, 2 months ago by CharlieHamu.
• This reply was modified 3 years, 2 months ago by CharlieHamu.

Thanks for the tips. I will clean up a few icon images that are being served http rather than https and then I’ll check using a couple of different devices in incognito troubleshooting mode. I’ll report the results later today.

I’ve reset many times. Just did again now (while in troubleshooting incognito mode). No change.

In detail:

The “Reset Site Kit” link didn’t actually disconnect me: I still saw my face in the upper right-hand corner. But I did go there and “Disconnect”, as I had done several times in the past. This time, after disconnecting, I had a button to connect and a link to reset just to the right of that button. So I reset again for good measure. Then when I went to connect, I got the message that Site Kit already had some access to my site (as I had received multiple times in the past). This time, for the first time, I went to my Google Account and removed all of Site Kit’s permissions first. Then they got re-added when I reconnected. Same results. Same “Your site might not be ready” before and same “You are probably offline” after.