Maybe they're being excessively picky. Technically the form needs to submit TO a secure page; strictly speaking it doesn't matter whether the page itself draws unsecure before any customer data is entered. But, it's still good to display those pages secure, if only for peace of mind, and to be sure that any re-displayed data after an error is also handled securely.
Zen Cart has always handled sensitive pages securely when you have ENABLE_SSL set to 'true' and HTTPS_SERVER defined to an https URL. And it appears your site is doing that normally.
But that doesn't stop someone from manually changing the URL from https to http ... which is maybe what Google is doing in their tests? While it's technically correct to "test" that, in reality none of your site's files (er, well, original ZC files) would generate any such links.
If Google is complaining that the padlock disappears even when the page is https, take a look at your Live Chat image ... which appears to be loading over http instead of https. Yes you should fix that; it's incredibly minor but it does break the fancy padlock and therefore confuses visitors and apparently also the might google.
I'd be asking Google for more SPECIFICS about what EXACTLY the problem is. Not some robot report, but an actual human.
.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole
Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.
