whynopadlock shows aform ssl error

Hi,
I checked my website ourceforherb.com with whynopadlock and one of the problems was (* is an s):

Insecure <form> call.
Found on line # 80 in file: https://www.sourceforherbs.com/index.html

(Note: Chrome will show a security error for any secure page with an insecure <form> call on the page)

Line 80 is:

How do I fix this and in what file???

Thanks
Marvin S.

Well there are several issues it seems. One, why do you have a index.html and not index.php as provided by ZC?
Two, why is the index/main_page encrypted, and three, probably going to get a lot of those type chrome issues if not mistaken, because the majority of form calls are representative of the need for the next form more than the current...

Though it would also help to know what version of ZC you are using, and possibly what template is installed as things like this are/can be template specific.

Thanks for your quick reply.

Take my answers as coming from a slightly technical novice.
1- Zen version is 1.3.9h, Template is Sophie Blue.
2- Where do you see index.html?
3- I can't answer the encryption question as I did not do anything specifically that would have encrypted this page
3- This is the only form problem found by whynopadlock

Thanks,

Marvin S.

marvin:

Thanks for your quick reply.

Take my answers as coming from a slightly technical novice.
1- Zen version is 1.3.9h, Template is Sophie Blue.
2- Where do you see index.html?
3- I can't answer the encryption question as I did not do anything specifically that would have encrypted this page
3- This is the only form problem found by whynopadlock

Thanks,

Marvin S.

Insecure <form> call.
Found on line # 80 in file: https://www.sourceforherbs.com/index.html

It may be a "generic" response from the program doing the search/test, but it didn't seem right.

So did you send whynopadlock to only investigate the main page or several other pages? Such as the login page, or the checkout page?

Main page only.

Simple solution: edit your /includes/configure.php file and set ENABLE_SSL to 'true' instead of 'false'.
Also make sure HTTPS_SERVER is defined to start with 'https://' and not 'http://'

Dr. Byte,

Still getting this error - Insecure <form> call. Found on line # 80 in file: - after I made the changes you recommended.

Thanks

Main page only.

Marvin

What happens if you fix the call to:
http://www.sourceforherbs.com/images/cot_black.gif

to know when and when not to use secure?

How do I "fix the call"? please.

you need to change the src calls for the cot image to call secure at all times. So your looking for this

src="http://www.sourceforherbs.com/images/cot_black.gif"

and change too

src="https://www.sourceforherbs.com/images/cot_black.gif"

I made the change and whynopadlock found no new problems aside from line 80.

Should I change the urls in line 80 to https?

Thnks,

Marvin S.

Unless you are planning on running your entire site in secure then why are you running whynopadlock on a page thats designed to NOT have a padlock, IF you want to run your site completely secure then make the change in your config files, making the define for http and https use the secure URL

Merlinpa1969,

Thanks,

Now I think I understand what whynopadlock is for.

Subject closed!!

Thanks

barco57:

you need to change the src calls for the cot image to call secure at all times. So your looking for this

src="http://www.sourceforherbs.com/images/cot_black.gif"

> 
> and change too
> 
> ```
src="https://www.sourceforherbs.com/images/cot_black.gif"

Even better would be to specify no protocol, so it auto-detects:

src="//www.sourceforherbs.com/images/cot_black.gif"

... or even better still would be to leave out the domain altogether:

src="/images/cot_black.gif"