runfrombears:
I don't quite understand this. I was told that I needed a dedicated IP to run an ecommerce store with SSL. My plan is only to use Paypal Express for check out. I will not be doing any credit card processing. I just want simple and cheap. Do I really need dedicated IP and dedicated SSL?
No.
runfrombears:
I was going to go with Rapid SSL namecheap for $10 a year. Still haven't decided on a host...
If you do spring for your own SSL certificate you will need to find a host that can provide you with a dedicated IP address. These go 'hand in hand'.
runfrombears:
I've got my design completed and ready to launch. Any tips is most appreciated.
My views on this tend to be the opposite to most. In most cases SSL gives a false sense of security. The premise of SSL was for encryption and authentication. These days it is virtually useless for authentication (anyone can purchase an SSL certificate for almost any domain name they like with no one and nothing to check/verify that they are who they say they are or whether they are even have any association with the name being registered).
It is still good for encryption purposes, but this only mitigates one of many possible 'security issues'. It's not the magic bullet that many would imply, and most sites seem to have far more serious 'security issues' than what SSL is designed to prevent (eg: Insecure file/folder permissions).
I even disagree with both of Kobra's comments.
Customers generally DON'T 'feel better when entering their sensitive information such as at login' for the simple fact that very few people actually look/check to see if they are entering data in a secure page or not.
Worse, if/when they are directed to an SSL enabled site for this purpose and receive a security alert that something is wrong, most people tend to click through and ignore the errors/warnings anyway. Only a few will actually go away and shop elsewhere. With no SSL at all there are no error or alerts generated at all, and this makes people feel a lot more 'comfortable' than entering the same data into a site that does produce the warnings, even if the SSL site is legitimate.
runfrombears:
It does make your site look more professional
Or not. Most people take no notice and make no distinction between an SSL enabled site and one without. They'll only notice it if/when the SSL errors/alerts are generated, which legit or not, makes the site look positively unprofessional. Even worse is when the entire site is SSL enabled. To those that actually care and understand what SSL is and does, this is a sure sign that the site maintainers/owners don't have the 1st idea about security. The SSL is advertising their ignorance (a hackers dream).
I mean no disrespect to those that promote and/or use SSL, it is still a valid and viable security measure if properly configured and implemented. My issues with it relate to the fact that more often than not it is totally misunderstood by most people, which leads to the false sense of security, which is generally worse than no security at all.
At the end of the day though, it is your choice.
Cheers
Rod
(adv dip network security)
NOTE: We are sorry that Rod is no longer with us.
We are grateful for all his contributions to the Zen Cart community.
Ozpost - The Ultimate Shipping module for Australian Merchants. Click these links for its Homepage, or Download from Zen-Cart.com.
