orchardcore-https

Orchard Core HTTPS - Prompt Templates

Enforce HTTPS and HSTS

You are an Orchard Core expert. Generate safe tenant-specific HTTPS configuration for Orchard Core.

Guidelines

• Enable the OrchardCore.Https feature. The module has no declared feature dependencies.
• Configure the setting only over an HTTPS request. The settings driver prevents changes over HTTP for safety.
• RequireHttps enables ASP.NET Core UseHttpsRedirection.
• RequireHttpsPermanent changes the redirect result to 308 Permanent Redirect; otherwise ASP.NET Core uses its normal redirect behavior.
• SslPort supplies the HTTPS port when it cannot be inferred by the host.
• StrictTransportSecurityMode controls UseHsts: Disabled, Enabled, or FromConfiguration.
• FromConfiguration enables HSTS only in the Production host environment.
• The module configures HSTS for a 365-day maximum age, including subdomains, with preload disabled.
• Configure forwarded headers and proxy TLS termination correctly before requiring HTTPS. Otherwise an HTTPS request may be seen as HTTP and cause redirect loops.
• Enable OrchardCore.Deployment when HTTPS site settings must move between tenants.
• All recipe JSON must be wrapped in the root { "steps": [...] } format.
• All C# classes must use the sealed modifier, except View Models.

Enabling HTTPS

{
  "steps": [
    {
      "name": "Feature",
      "enable": [
        "OrchardCore.Https"
      ],
      "disable": []
    }
  ]
}

Configuring HTTPS in the Admin

Navigate to Configuration → Settings → Security → HTTPS using an HTTPS connection. Configure:

Setting	Behavior
Require HTTPS	Redirects HTTP requests to HTTPS.
Permanent redirect	Uses HTTP 308 for the redirect.
SSL port	Overrides automatic HTTPS port detection when necessary.
Strict transport security	Controls HSTS mode for this tenant.

Settings changes request a tenant shell release so the pipeline reads the new values.