Stand With Ukraine. Stop Putin. Stop War.

As promised in a recent announcement, I was going to provide some tips on serving MODX sites over SSL based on my move to a complete SSL-based website. Here they are!

SSL Tip 1: Using protocol insensitive URLs for assets from the get go

You can apply this tip, even if you are not going to be serving anything over SSL soon! If you, like me, point to assets complete with the domain, you will risk serving non-secure content when making the switch. This is easy to prevent by not specifying the protocol, which is the "http" or "https" part.

An example before:

and after:

So basically you take a full URL, and instead of specifying "http://" or "https://", you simply specify "//" which will make it relative to the protocol in use.

SSL Tip 2: Generating HTTPS urls with MODX by default

When using the url syntax (like [[~1]]), this is usually relative to the site_url, the default. However it's easy to change this to use any other scheme both on a per case basis, and across the entire site through a system setting.

To change one link, pass &scheme=`https` to the link tag. Wait, you can add properties to link tags too? Yeah! For example, this is completely valid: [[~1? &scheme=`full`]].

To change all links to use https, find the link_tag_scheme system setting and change its value to "https". When not using https, I like to change this setting to "http" so all urls are absolute. All possible values for the &scheme property or link_tag_scheme setting can be found in the makeUrl documentation

Now, there are some Extras that don't neccessarily follow suit here and use their own defaults. Wayfinder, for example, has its own &scheme property you will want to change. And when Wayfinder points to the homepage of a context, it points directly to the contexts' site_url, so make sure that has https as well.

SSL Tip 3: Telling Quip to use secure Gravatar URLs

If you're using Quip for comments (like me!), you will usually use Gravatar for comments which usually serves over http. Luckily, Gravatar does offer a secure link to avatar images but Quip isn't aware of that by default. But it does give you the opportunity to change the link to the gravatar images. This allows you to use a proxy on your own server, or to point to the secure Gravatar url instead! :) This is the &gravatarUrl property. As the secure url for Gravatar is, that's what we set the property to.



That concludes this list for now. Do you have any good other ideas? Let me and other readers know in the comments below.

I've been really busy at my new job in between moving, throwing anniversary parties for the folks and trying to manage a couple of projects I'm still involved in personally. I've got some article ideas (and drafts) nearing a publish-ready state, but it really has been too quiet. In this post I want to provide you with a few quick updates with a promise for more quality posts "coming soon"!

Slight updates to my Design

You may have noticed while browsing the MODX Blog, Category or Archive pages, but I have been spicing things up a tiny bit! Blog items now show up with images in the listings, and the homepage has been updated to funnel people to the blog more easily as well. I am also using more images in article contents where applicable using my MIGX Gallery set-up and I have subtly improved the way my sidebar widgets appear on tablets. If anything my site is a constant work in progress and I hope you can appreciate these updates. If you have any feedback be sure to get in touch, or to leave a comment!

Doing my bit to make the web more Secure

Obviously by simply using MODX I'm doing my bit to make the web a more secure place to hang out at, but over the past week or so I've been working with my awesome hoster on serving my site over SSL.


Well, why not?

I'm already paying for a VPS (I need the processing power and storage for one of my personal projects) and as SSL certificates start at like €15 a year, I couldn't come up with a good reason not to. My visitors will be able of browsing my site securely (even if there's no log-in or personal data going 'round) and it's a nice experiment in general. 

There were a few challenges to getting to this point, but all in all it went mostly smoothly.

  1. The site needed to move to its own dedicated IP. Normally this is quite smooth, but it resulted in a few hours of down time due to the odd way I originally set up this site, which meant that for this to work smoothly, the site needed to be migrated to a new user on the server manually (which is harder than it may sound with all the loosely connected legacy cruft this site has already built up!). 
  2. As I've been using an assets sub-domain (among others) to split requests and speed up site loading, the sub-domain also needed to be served over SSL. Patrick did a great job helping to get that up and running. 
  3. This is probably the most annoying challenge, which is making sure you do not point to any non-ssl scripts or images - anywhere. There's stylesheets in the header, scripts in the footer, and most importantly: images in the content. There is also comments which uses Gravatar over non-SSL by default.

I will be publishing a new article probably next week with some specific and easy to action tips on preparing your MODX site for running over SSL.. stay tuned for that! Over the next few days I will start enforcing HTTPS as well (you can still visit over HTTP for now by changing the url), so if you do spot any issues - be sure to let me know!

VersionX 2.0.0-rc2 and 2.0.0-rc3!

I have to admit: VersionX is my favorite Extra right now. It sits in the background doing its thing, and when you screw something up you can go back and restore an older version. RC2, released on May 28th and RC3 released on July 8th, both fix a number of bugs that people have reported on the Github page, and it now has an interface for all data it collects! The next version will likely get rid of the "release candidate" moniker and introduce some more restore options that are not yet available. 

Read more about VersionX, just download the package, or make a donation

getRelated 1.2.0

If you don't know what this is, getRelated can be used to automatically show related items on a Resource. It's used in this site and I have seen many examples of it in use all over the place. By taking a getResources-like approach and offering easy ways to customize the sorta complex algorithm it uses, the result can be fine tuned to the bone and templated all the way you want it. 

In the June 7th release of getRelated 1.2.0 this is even further improved, as it now features a &stopwords property to assign a custom comma separated list of words to ignore for that instance, it properly supports multiple (different) snippet calls per page now, adds Russian support and the default output is now a bit more sensible too.

Read more about getRelateddownload the package or read the documentation.


While released in March already, I never really publicized it much, but with the MODX Cloud Beta rolling out (which was the inspiration for writing it!) I'm plugging it here. ContextRouter is a plugin that eases setting up different (sub)domain contexts by taking your http_host context settings into a custom cache file, and routing requests to the proper context based on that. It's available via the package manager as well.