I run a store selling digital products and for me it is very important to show customers that my ENTIRE store is safe. Also Google have started to reward sites ussing SSL. http://googlewebmastercentral.blogspot.se/2014/08/https-as-ranking-signal.html

I would like to use SSL (https) on all my Frontend pages in Magento. I have searched the forum and Google for answers and/or extensions but without result.

Does anyone know how to achieve this? Also, should i except any problems when doing this? I know that the speed will be reduced but that is OK.

up vote 18 down vote accepted

The redirect to HTTPS root has nothing to do with the unsafe URL setting and the .htaccess setting suggested is not required.

If you have issues when redirecting from http://yoursite.com/your_product.html to https://yoursite.com/ when using HTTPS, just go to:

System -> Configuration -> General -> Web -> Redirect options

And set:

Auto-redirect to Base URL -> No

If you need to fix broken URLs from broken addons/styles by changing href="http://somewhere... or src="http://somewhere..." into href="//somewhere... and src="//somewhere..." as usual to prevent mixed content issues. Of course, all external services should support HTTPS, but keep in mind the slowdown of having external resources.

Set your base url for both your secured and unsecured site to https://yoursite.com/. That's all you need to do.

  • Hi Pronto! Thanks for your answer. Is it really that simple? I have read some (magento.stackexchange.com/a/9891/13106) about issues due to extensions and modifications when using SSL. My guess would be that if i use SSL on all pages these issues would increase even more - what do you think? – Tobias Bindemo Aug 11 '14 at 22:13
  • 2
    I explained how to activate SSL for Magento front end, provided that you already have it. How to acquire and install SSL certificate is a general web server configuration issue and sort of off-topic for this SE. – Pronto Aug 11 '14 at 22:29
  • @Pronto I believe Tobias was asking if it affects Magento extensions, rather than how to aquire and install SSL certificate – rybo111 Apr 28 '15 at 15:17
  • This one is the best solution. – Pandurang Patil May 4 at 8:26

ITS NOT THAT SIMPLE... There is a problem with changing the store unsecured url to https. Any links to existing pages, including links from ads, indexed pages in Google, etc, that point to http://yoursite.com/your_product.html will be redirected to https://yoursite.com/

You will need to go through your theme and make sure that there are no references to http:

and then...

You will also need to redirect all http: requests to https: in your htaccess file with code similar to this:

############################################
## REDIRECT TO HTTPS ALWAYS
    RewriteCond %{SERVER_PORT} !443
    RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

it will need to be inserted somewhere after this in your existing htaccess file:

############################################
## enable rewrites
    Options +FollowSymLinks
    RewriteEngine on

You will need to adjust this to your specific situation and server set up.

  • Hi Jon, Thank you very much for this information. It will for sure help me when it is time to secure the shop! – Tobias Bindemo Aug 21 '14 at 20:39

My suggestion is, hold your horses.

For example, if you are using Magento Enterprise Edition, HTTPS for the whole site will stop Magento’s Full Page Cache from working. We created a fix, for anyone to use - https://github.com/elastera/EnterprisePageCacheSSL (your feedback is greatly appreciated).

Your Page Load time could be increased significantly, due to SSL handshakes and possibly many 3rd parties scripts.

If you use a CDN, make sure you don't end-up paying an arm and a leg for installing a custom SSL certificate on their edges.

I recently wrote a blog post with details regarding this very topic: "Why Google’s advice on HTTPS will screw your Magento site"

Sorry if I did provide a step by step how-to guide, but I hope I made clear possible obstacles ahead of you.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.