making the whole site SSL

[streak]

i got it to work. When people checkout and all. But i would like to know if i can make the whole site be SSL. so customers feel like its a safe place to shop from the start. Thanks for your time.

[yellow1912]

i got it to work. When people checkout and all. But i would like to know if i can make the whole site be SSL. so customers feel like its a safe place to shop from the start. Thanks for your time.

SSL is NOT needed when no private data is transferred. And note that ssl is slower that the normal protocol

Try going to amazon.com for example, do you see them use ssl on every page?

[streak]

ok thats what i thought. Thanks for the info. If its slower.. thats the last thing my site needs. :)

[barco57]

Plus it will toss any page rank you have on google in the toilet. Search engine will crawl secure pages but do not assign any page rank to them

[mathewchan]

It does not make sense to use SSL on the whole site. No one cares about which page and who is browsing the website if there is no sensitive information.

The website will be rendered very slow if you implement SSL on the whole site. Web surfers are impatient, especially new visitors. If they don't see your pages load in a few (probably 5) seconds, they would just close the site, since there are so many results on the google/yahoo pages, you're thrown out of the sea.

However, I would recommend you secure the whole admin section of the website, which current zen-cart version does not do (it only secures the login page).

The way of doing it is easy, just go to the admin/includes/functions/html_output.php and modify the function zen_href_link

add a line to set the variable $connection = 'SSL';

but you might encounter minor problems on some pages since they were not originally written for the SSL environment. However, I don't see so many so far.

[mathewchan]

Forgot to mention that:

Please make sure that your transaction pages and login pages are secured. This is very important.

[Ajeh]

mathewchan, the easy way to make a site totally secure is to just edit the configure.php files and only use the secure URL for both the secure and non-secure settings ... there is no reason to touch the code for this change ...

Granted, I prefer to have sites get spidered so folks can find it, as barco57 pointed out ...

[mathewchan]

mathewchan, the easy way to make a site totally secure is to just edit the configure.php files and only use the secure URL for both the secure and non-secure settings ... there is no reason to touch the code for this change ...

Granted, I prefer to have sites get spidered so folks can find it, as barco57 pointed out ...

thanks! Yea you are right. It is much easier to set the SSL status to true in the configuration file. But I think the admin side wasn't written as a complete SSL environment, therefore by turning on SSL status in the configuration file just secures the admin login page, not other pages.

Or may be I'm wrong? Or is there actually a parameter to make the whole admin environment secure?

[Merlinpa1969]

If you use the secure url in ALL 4 spots in the admin config thats all you need to do,
no code changes needed....

also IF you are using a shared ssl then you may lose the ability to use the wysiwyg editor

[mathewchan]

If you use the secure url in ALL 4 spots in the admin config thats all you need to do,
no code changes needed....

also IF you are using a shared ssl then you may lose the ability to use the wysiwyg editor

Oh I figured. Thanks so much! I was being stupid.