I want the site to only have ssl in the account and checkout pages.

It seems that if in the admin I select "Use Secure URLs in Frontend" I get that.

The issue is that while product pages, and links to products simply use HTTP (which is fine), it changes all the AJAX adding links to HTTPS. And that causes the ajax error in Chrome:

No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://site.com' is therefore not allowed access.

I don't need the site to be in HTTPS when on the product page, so why are the ajax urls being created as HTTPS when the links to the products aren't?

How can I fix it so even though "use secure urls in frontend" is selected, it doesn't do that for the links?

EDIT: This was a couple projects ago, but I had ended up fixing it on the client side. Most of the ajax calls were sent through a js function. I took the url, and used some regex to change all the requests to "//site.com/..." basically just removed the http/https entirely. I think that took care of the majority of it.

3 Answers 3


Fixing links like this is going to depend on what created that link. I have seen so many times some custom navigation or footer templates that hard code their URLs.

For reference, here is a handy way to check the current protocol and build a URL based on that:

$this->getUrl('my-page', array('_forced_secure' => $this->getRequest()->isSecure()));

Also worth pointing out, as of recently Google now rewards HTTPS only sites with improved search rankings. Whatever that means. Of course, nobody outside of Google can quantify that, so YMMV.

  • Basic to Google's decision and all, if you're into all sorts of tracking, incentives and other add-ons that require loading external javascripts, the SSL negotiations are going to add up so you'll get the HTTPS award in exchange for the speed demerit. It is to be seen how badly off balance the two are going to leave Google's assessment of your website. Commented Oct 21, 2014 at 5:29

You Can Check Condition before Form of Product View Page. This is depend on that is you page secure or not. You can add logic in template/catalog/product/view.phtml

Before form you can check is page is secure or not.

  You can create secure add to cart url if Product Page is secure
  $addtocarturl = your secure add to cart url
  You can create unsecure add to cart url if Product Page is unsecure
  $addtocarturl = your unsecure add to cart url

<form action="<?php echo $addtocarturl; ?>" method="post" id="product_addtocart_form"<?php if($_product->getOptions()): ?> enctype="multipart/form-data"<?php endif; ?>>

Instead of ghetto code work arounds, look into CORS to properly solve this:


Not the answer you're looking for? Browse other questions tagged or ask your own question.