Zen ID remains in URL if storefront is set to HTTPS

[welshop.com]

here they are:

Session Directory 	/home/******/public_html/cache 	 
Cookie Domain 	        True 	
Force Cookie Use 	False 	
Check SSL Session ID 	False 	
Check User Agent 	False 	
Check IP Address 	False 	
Prevent Spider Sessions 	True 	
Recreate Session 	        True 	
IP to Host Conversion Status 	true 	
Use root path for cookie path 	False 	
Add period prefix to cookie domain 	True

[lat9]

You could try (cautiously) changing (one at a time) the Use root path as cookie path and Add period prefix to cookie domain settings.

After each change, you'll need to reset your browser's cookies for the domain so that you're not locked out of your admin.

------------

Update: I take that back. Try first setting Cookie Domain to False.

[swguy]

Try just switching to PHP 7. I have seen situations where this single change resolves issues with sessions.

[welshop.com]

Cant move to php7 at the moment as I am running a Live 1.5.1 site on the same server and I believe its not compatible.

Will test the setting changes Lat9 suggested and see if they have a positive impact.

[welshop.com]

Changed Use root path as cookie path and Add period prefix to cookie domain settings both individually and then both together and still no change.

[lat9]

How about setting Cookie Domain to false?

[welshop.com]

Tried that and the ZenID still remains until I click the home link in either the header or footer.

[DrByte]

I've clicked around the store, adding/removing items from the basket, without any zenid following in the URL. The cookie appears to be set properly on first visit.

[welshop.com]

The test site with 1.5.6 on is on a subdomain with only my ip whitelisted so I assume you were looking at my live site which is still running 1.5.1

[DrByte]

Here's one thing to check: visit the site afresh, then go into your browser's Inspect panel and look at the Storage section, where it shows cookies.
Look at the cookie domain. Then click around your site. Does the cookie domain match the URL? Does it change from page to page? Does it change between http and https?

If the cookie doesn't match the domain, it won't sync up, so PHP won't be able to read it and therefore won't retain any activity such as add-to-cart or login etc.
This is a common problem on subdomains, which usually disappears on the root domain. It can sometimes be resolved by tweaking ZC sessions configs or by tweaking server configs. But if it's going to be in the root domain eventually anyway then it's moot.