For the final part of reminding myself how to secure a linux website, I need to include the bit on how to force unsecure traffic to be secure. This is done using rewrite rules to rewrite the url path from http:// to https:// you can make the whole site redirect to secure, or just certain subsections of the site.
To force the whole site secure, you first need to run x2 versions of the site, a secure version listening on port 443 and a non-secure version listening on port 80. You then need a rewrite rule on the port 80 site that basically say if this url is http:// rewrite the url to be https://
The config to do this is below and needs to be included between your <VirtualHost> tags on the non-secure site config
RewriteEngine On
RewriteCond %{SERVER_PORT} !443
RewriteRule (.*) https://www.sporticia.com/ [R]
This basically says if the url is not on port 443 then rewrite the url to be https://blah
As the re-write rules are written using regular expressions, you can actually do some pretty complex stuff, examplex of which you can find here and also here
