We never had the new generation of Magento until now. And on all the previous versions (1.x.x) we ALWAYS needed to buy and have an SSL certificate installed (otherwise browsers would throw these scary messages at customers who were placing orders saying that placing the order is unsafe and they should get out of there)

We now have Magento 2.1.0 with Paypal and NO SSL certificate installed. There seem to be no Errors or scary messages anywhere and things seem to work just fine. Do I have to buy an SSL and have it installed or are we fine without it?

clarification: This is a brand NEW domain which never had an SSL installed on it. There hasn't been any actual customer orders placed just yet (even-though it's live) - just a test order by us.

  • Yes. And it's not just because you use PayPal. You should use a SSL certificate anyway! – Anna Völkl Sep 27 '16 at 10:33

Yes. It's not about hiding scary messages, it is about protecting your customers.

And this is important, even if the payment is handled by PayPal (and PayPal uses SSL).

Can people create an account on your site?

Then imagine, they log in with public WiFi. Without SSL, anybody in the same network can look at the traffic and see the transmitted password and email address. Now unfortunately, there are still many people who use the same password for everything, so chances are, the "hacker" gets access to the PayPal account, too.

There you have your worst case, and it's not even far fetched.

Another scenario is that without SSL, man in the middle attacks are possible. The attacker could change the response you are sending and server malware or trick the user into paying to a different paypal account.


Im surprised that paypal let you parse/purchases without an SSL. Typically you would need an ssl to parse private information. If you had an SSL prior... that would mean that your SSL is most likely still on the server and is still being noticed by paypal. Are you using the same domain.com as prior to your current magento install? SSL's are based on the domain not the files on the server. In other words if you had an SSL for your domain you would probably still have the SSL for the domain unless you actually removed the SSL from the server.


  • No - this is a completely new domain with the new Magento version. The customers are taken to the Paypal website for the payment part and then returned back to our site. – Allysin Sep 26 '16 at 21:23
  • True enough SSL is not ""Required"" however, as an online merchant it is the responsible thing to do and the minimal cost of an SSL nowdays is so much better than how much it could cost if your site is not secure. I'm guessing that you are storing peoples names and addresses AND phone numbers..... – user26152 Sep 26 '16 at 21:32
  • Yes - we plan to store people's names, addresses and phone numbers but isn't SSL suppose to protect the customer's information when it's being transmitted from their computer to the server? What are the odds that someone would try to hack that connection just to get a name, address and a phone number? Aren't there on-line directories where this information is available anyways? And the Payment part is 100% secure because it happens on the Paypal Portal...Please help me understand what the big deal is.... – Allysin Sep 26 '16 at 21:41
  • hmm you may want to ask someone who's identity has been hacked ..what the big deal is. The point here is that its just one more way that we store owners can help customers have a safe shopping experience ....NEED or not ...its just smart and responsible. EG: our homes have locks ..but we live in safe area but you are supposed to ALWAYS lock your doors. – user26152 Sep 26 '16 at 21:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.