HTTPS on Customer create account page?

[klevans2015]

Hi

Been trying to set up google merchant center feeds and all has check fine but they say my customer registration page needs to be HTTPs as it is not secure running v1.5.4 of zencart not sure on this as I have not seen this issue before is there a way to enable HTTPs on this section at all.

book - axis .co.uk

[lat9]

I don't understand the issue (who's they?). When I go to your site and click on the "My Account" link, I'm taken to the login/create-account page that is using https protocol.

[RixStix]

I received a 'mixed content' error (FireFox) which might be the reason for the complaint.

Could it be the link in the footer following the copyright notice?
Hardcoded link in the "Chat" button?
or others?

[lat9]

I received a 'mixed content' error (FireFox) which might be the reason for the complaint.

Could it be the link in the footer following the copyright notice?
Hardcoded link in the "Chat" button?
or others?

Oh, nice catch, RixStix!

[klevans2015]

Cheers

I will have a look at that as originally it was account page was non HTTPs, I have had to make all pages on the store front now HTTPs to pass Google Merchant checks, (that is who they are).

The Engineers at Google said account page has to be HTTPs

I have looked around and account page to register as a new customer is not secure on zencart from two sites and a default set up I have checked over

[DrByte]

Maybe they're being excessively picky. Technically the form needs to submit TO a secure page; strictly speaking it doesn't matter whether the page itself draws unsecure before any customer data is entered. But, it's still good to display those pages secure, if only for peace of mind, and to be sure that any re-displayed data after an error is also handled securely.

Zen Cart has always handled sensitive pages securely when you have ENABLE_SSL set to 'true' and HTTPS_SERVER defined to an https URL. And it appears your site is doing that normally.

But that doesn't stop someone from manually changing the URL from https to http ... which is maybe what Google is doing in their tests? While it's technically correct to "test" that, in reality none of your site's files (er, well, original ZC files) would generate any such links.


If Google is complaining that the padlock disappears even when the page is https, take a look at your Live Chat image ... which appears to be loading over http instead of https. Yes you should fix that; it's incredibly minor but it does break the fancy padlock and therefore confuses visitors and apparently also the might google.


I'd be asking Google for more SPECIFICS about what EXACTLY the problem is. Not some robot report, but an actual human.