SSL is on, but http:// login page does not redirect to https://

[jackie.taferner]

I have SSL turned on in both configure files, and all of my shopping cart and login pages appear to redirect properly to the https:// pages.

BUT if I specifically type in http://www.mystore.com/index.php?main_page=login it does not redirect to the https:// version of the page. This is causing a PCI compliance error.

Any thoughts what could cause this problem?

Thanks!

[tino.schlegel]

Its the same for me, but the form sends the information to the secure link. That should be fine. So its not a problem as you said. I guess you can change the code and redirect always to the secure page for the login. Maybe in you htaccess file that would be the easiest as you dont have to change code.

[jackie.taferner]

i suppose it shouldn't be a problem. but PCI compliance scanner is still giving errors for it

do you have an example code that should be put into htaccess?

[jackie.taferner]

Apparently it's a false positive from the PCI scanner... so we'll be awaiting the results once more and have another go at it.

wish me luck :)

[anbuallinone]

Hello there, I am going through the same problem. I want to redirect the unsecure login page to ssl login page.
could you please tell me what i am supposed to code in htaccess file?

Many thanks in advance

[Kim]

https://www.zen-cart.com/tutorials/index.php?article=14

[jackie.taferner]

Hello Kim,

Thank you for the reply. But the SSL is already turned on, as instructed in that tutorial.

The issue is that after running a PCI scan, the site has failed becuase they were able to hack and get to the login page without using the https://

ie, if you type in the login URL directly into the address bar, using http:// it will allow you to get there, instead of forwarding you along to https://

[Kim]

The issue is that after running a PCI scan, the site has failed becuase they were able to hack and get to the login page without using the https://

ie, if you type in the login URL directly into the address bar, using http:// it will allow you to get there, instead of forwarding you along to https://

Why should they care? A real customer is never going to change the URL and the information is still sent via HTTPS when it is submitted.

[jackie.taferner]

I agree, why should they care... but they do, and if it's not fixed my website does not pass PCI compliance.

What can i do to fix this?

[anbuallinone]

https://www.zen-cart.com/tutorials/index.php?article=14

Kim,

Many thanks for your reply. i did have a look at the tutorial before i posted my previous message. in fact that is how is learnt how to turn on ssl. the trouble i got now is that, when i go to admin login page the ssl is on but when click on Log in page in the site (as a customer) it is not diverting to https://iwantthattoy.co.uk/index.php?main_page=login instead it remains as
http://iwantthattoy.co.uk/index.php?main_page=login


Help please!