SSL secure entire Frontend (all pages)

Question

I run a store selling digital products and for me it is very important to show customers that my ENTIRE store is safe. Also Google have started to reward sites ussing SSL. http://googlewebmastercentral.blogspot.se/2014/08/https-as-ranking-signal.html

I would like to use SSL (https) on all my Frontend pages in Magento. I have searched the forum and Google for answers and/or extensions but without result.

Does anyone know how to achieve this? Also, should i except any problems when doing this? I know that the speed will be reduced but that is OK.

Answer 1

The redirect to HTTPS root has nothing to do with the unsafe URL setting and the .htaccess setting suggested is not required.

If you have issues when redirecting from http://yoursite.com/your_product.html to https://yoursite.com/ when using HTTPS, just go to:

System -> Configuration -> General -> Web -> Redirect options

And set:

Auto-redirect to Base URL -> No

If you need to fix broken URLs from broken addons/styles by changing href="http://somewhere... or src="http://somewhere..." into href="//somewhere... and src="//somewhere..." as usual to prevent mixed content issues. Of course, all external services should support HTTPS, but keep in mind the slowdown of having external resources.

Answer 2

ITS NOT THAT SIMPLE... There is a problem with changing the store unsecured url to https. Any links to existing pages, including links from ads, indexed pages in Google, etc, that point to http://yoursite.com/your_product.html will be redirected to https://yoursite.com/

You will need to go through your theme and make sure that there are no references to http:

and then...

You will also need to redirect all http: requests to https: in your htaccess file with code similar to this:

############################################
## REDIRECT TO HTTPS ALWAYS
    RewriteCond %{SERVER_PORT} !443
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

it will need to be inserted somewhere after this in your existing htaccess file:

############################################
## enable rewrites
    Options +FollowSymLinks
    RewriteEngine on

You will need to adjust this to your specific situation and server set up.

Answer 3

Set your base url for both your secured and unsecured site to https://yoursite.com/. That's all you need to do.

Answer 4

My suggestion is, hold your horses.

For example, if you are using Magento Enterprise Edition, HTTPS for the whole site will stop Magento’s Full Page Cache from working. We created a fix, for anyone to use - https://github.com/elastera/EnterprisePageCacheSSL (your feedback is greatly appreciated).

Your Page Load time could be increased significantly, due to SSL handshakes and possibly many 3rd parties scripts.

If you use a CDN, make sure you don't end-up paying an arm and a leg for installing a custom SSL certificate on their edges.

I recently wrote a blog post with details regarding this very topic: "Why Google’s advice on HTTPS will screw your Magento site"

Sorry if I did provide a step by step how-to guide, but I hope I made clear possible obstacles ahead of you.

Answer 5

For Magento CE 1.9.4.3, I needed to set

Use Secure URLs in Frontend = Yes
Use Secure URLs in Admin = Yes

in admin > System > Configuration > Secure:

I didn't do any other configuration at the server level.