trouble enabling HTTPS for my website

Hello,

We are in the process of starting our website and have hit a bit of a snag when trying to enable HTTPS for our website.

I've followed the directions found here:
https://www.zen-cart.com/content.php?56-how-do-i-enable-ssl-after-i-have-installed-zen-cart

attached are screencaps I took of the information that was changed.

I have tried different computers and different browsers. I am not sure what I am missing.

https://www.herbstocare.com
Zencart 1.5.3

While not a direct answer to your question, why are you starting a website using Zen Cart 1.5.3 (released in July of 2014) rather than Zen Cart 1.5.5e (released in March of 2017)? There are a ton of corrections and improvements in that current release.

Having the same problem (mixed content) with 1.5.5, so version likely not the problem.

lat9:

While not a direct answer to your question, why are you starting a website using Zen Cart 1.5.3 (released in July of 2014) rather than Zen Cart 1.5.5e (released in March of 2017)? There are a ton of corrections and improvements in that current release.

I honestly don't know. My boss had someone else start up the website and I'm working on getting it functional. I did suggest updating to 1.5.5e, but they said that wasn't necessary. I think the guy who set up the website liked 1.5.3 more than 1.5.5e.

Not my call so I get to work with what I have.

That "someone else" chose to use a TemplateMonster template which looks good ... until you try to get it functioning properly. They're notorious on the Zen Cart forums for their disregard to "standard" Zen Cart layout, making it more difficult to add well-behaved plugins.

I'll note that your configure.php files reference the site as http[s]://herbstocare.com while the link you posted is https://www.herbstocare.com, so you'll need to use .htaccess rules to redirect from the www. form of the URL to the www-less form. Other than that, I don't see what the ***snag ***is.

lat9:

you'll need to use .htaccess rules to redirect from the www. form of the URL to the www-less form.

I'll be googling this htaccess rules thing. If you could, send me a link just in case. I know it shouldn't be hard to find, but I've been at this for like 3 days now...

Okay, so I found this:
https://www.zen-cart.com/showthread.php?212837-Changes-in-htaccess-and-SSL

I got the .htaccess file and added:
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule (.*) https://herbstocare.com/

to the top.

While https is appearing in the address bar it is also telling me the page is not fully secure.

Also, when I try to add things to a shopping cart it doesn't actually change the cart.

I decided to do a clean install of firefox to try out the website.

I get a green lock in the address bar that says the website is secure, but when i try to add something to the cart i get a popup that says the information will be sent over an insecure connection. Clicking Continue also doesn't actually add it to the cart like I was experiencing in my last post.

By going this route of using an htaccess to force all https:, the configure.php files need to be updated to suit, that said the template may still be an issue even after that.

Remember that changes to the includes/configure.php file require changing the permissions to 644 to be able to save the change(s).

I do believe that an additional action of the htaccess was to address if https is "on" but the www. is included (desired to not direct/allow to direct to version with www. as the prefix...)

mc12345678:

By going this route of using an htaccess to force all https:, the configure.php files need to be updated to suit, that said the template may still be an issue even after that.

Remember that changes to the includes/configure.php file require changing the permissions to 644 to be able to save the change(s).

I do believe that an additional action of the htaccess was to address if https is "on" but the www. is included (desired to not direct/allow to direct to version with www. as the prefix...)

I don't know what 644 is.

Herbs2Care:

I don't know what 644 is.

What do you use to modify files on your server? 644 is the permissions that allow editing of a file. May also see reference to chmod which allows editing of the permissions.

The files are with inmotion hosting using cpanel

Okay, if you use the file manager in cpanel, you would navigate to the file you want to edit. If the file is includes/configure.php, you will need to navigate the left-hand folder view to get to the includes directory. You should see a modules folder and a templates folder at the bottom of the folders listed in the right-hand panel.

Scroll down till you see the configure.php file. All the way to the right is the permission for that file. It is probably set at 444 while all the others around it are 644. The difference? 644 can be changed: 444 is "locked".

Click the iccon next to configure.php and it will be highlighted. In the top menu, find Permmissions and click on that. it will show you a representation of the current permission settings. In the case of EITHER configure.php file, you will need to make sure that the file is 644 to edit and then returned to 444 after editing. Simply click the spot for User Write and the numbers will change to 644. Now you can edit and save the file.

When you're done, be sure to change the permissions back to 444. Just un-check the User Write.

It's currently set to 0440. What does that mean? I'll give it a try with 644.

Herbs2Care:

It's currently set to 0440. What does that mean? I'll give it a try with 644.
It means that there are even fewer ways to read/execute the file than how others have it setup.

In your case you would want to go for 0644 or at least 0640 to be able to edit the file. And so you further understand, the edit is about being able to save changes.

It is one thing to be able to open a file, move the cursor around, add, delete, and modify information that is seen on the screen and it is another thing to save those changes. The edit permissions relate to being able to save the changes.

After saving, suggest also refreshing the screen and then opening the file to verify that the changes were actually saved.

Herbs2Care:

It's currently set to 0440. What does that mean? I'll give it a try with 644.
:shocking:
If you look at the permissions pop-up, you'll see that 440 means that the World cannot even see the file. Each configure should be set to 644 to edit and 444 after the changes are saved.

Okay, I've changed the permissions to 0644 before editing and then to 0444 after editing. No effect.

I am noticing that there is a little notice that says "this page is trying to load scripts from unauthenticated sources." It has probably always been there, but it seems like it may be important. It has probably always been there, but I am noticing it now so I don't think it is new.

Also, am I editing the right .htaccess file? I'm seeing it all over the place. Which one should I be editing?

And now I think I've really screwed it up as our website theme no longer loads.

Herbs2Care:

Okay, I've changed the permissions to 0644 before editing and then to 0444 after editing. No effect.

I am noticing that there is a little notice that says "this page is trying to load scripts from unauthenticated sources." It has probably always been there, but it seems like it may be important. It has probably always been there, but I am noticing it now so I don't think it is new.

Also, am I editing the right .htaccess file? I'm seeing it all over the place. Which one should I be editing?
To force everyone to https and to or not to www., the htaccess file that would be necessary would be in the root of your store where you have index.php, the includes folder, the images folder, the editors folder, possibly the extras folder (if it is still on the server), the ipn_handler.php file, the ajax.php file, etc... in a default install of ZC such an htacess file is not present and must be created to accomplish what has been suggested. If another htaccess file has been edited, then it could explain some of what is being seen. As far as the world being able to see the includes/configure.php file it doesn't so that particular setting is of no consequence.

Now one thing I noticed is that by selecting the link that was provided in the OP, I was not redirected to https nor was the www. removed, so that does seem like something is amiss. The links on the page all point to a www-less link which is what has been suggested based on other reviews, but nothing (yet) redirects a www address to a non-www address when trying to access the site initially. (htaccess in the root is supposed to do that)