Just thought I would throw this out in case this is not correct... - I use hosting that apparent does not play by some rules when it comes to path configurations and found it necessary to add RewriteBase / to the .htaccess file as follows:

...

Options -Indexes
<IfModule mod_rewrite.c>

RewriteEngine On
RewriteBase /

...

In order to properly handle http & https I added the following:

...

# I added this to redirect http to https
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301,NE]
Header always set Content-Security-Policy "upgrade-insecure-requests;"

...

However, after install of of V9.0.x is it OK to use backup of older version?? (8.9.x)

THX

Mike

Another question : after upgrading site to latest Zenario Version if I decide I want to restore a my site from an older back-up from a few months back -- can I restore backups from older version of Zenario without having to reinstall or recreate a blank DB? 

Hey, just to add one small point to this. There is actually a limit to how far back you can go when restoring a backup.

The current version of Zenario requires that your backup be taken from a copy of Zenario that's was least version 8.2 or later.

In practice this means that if you have a backup that's no older than about 3 or 4 years, it should be fine.

Hi Mike, 

Thanks for your feedback, glad you like the product!

Just to reply properly on your question about .htaccess files, you are right to observe that there could be better rules in .htaccess to direct users' browsers to https.

I guess we've not put those things into .htaccess by default because it could hamper people setting up a site that's temporarily on http and don't yet have their certificate/https set up correctly. The other issue, depending on how many domains point to your site, is that the use of %{HTTP_HOST} is a wildcard, and so http requests on any domain that point to your site will be redirected to the https, whereas you probably would all of them pointing to whatever you consider your "primary" domain. 

Here is what we have on many of our hosted sites, in an Apache virtual host file:

<IfModule mod_ssl.c>

<VirtualHost *:443>

        ServerName zenar.io

        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"

        ## Error log, certificate info, DocumentRoot and Directory here

</VirtualHost>
<VirtualHost *:443>
        ServerName www.zenar.io

        ## Error log, certificate info here

        RewriteEngine On
        RewriteRule ^ https://zenar.io%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
</IfModule>

<VirtualHost *:80>

        ServerName zenar.io

        ServerAlias www.zenar.io

        ServerAlias tribiq.com

        ServerAlias www.tribiq.com

        RewriteEngine On

        RewriteRule ^ https://zenar.io%{REQUEST_URI} [END,NE,R=permanent]

</VirtualHost>

But essentially, it achieves a similar thing, and if you only use one domain on your site then your .htaccess modifications look perfectly sensible.

Note to check out video tutorials such as this one (unless you're already doing this!) to make sure you get the most out of aliases.

best regards

Tony