I'm looking to make my site entirely secure for 2 reasons. 1. Google has indicated that this will become a ranking factor and 2. I've invested in a EV SSL certificate and would like to show visitors that are browsing that the site is 100% legitimate.

Question 1: Is it enough to set the Unsecure Base URL's to https://www.mysite.com/ and is there additional settings needed to be carried out in the .htaccess file?

Question 2: Does the magento caching system work with https? Is there a FPC that will work efficiently with https?

Question 3: After the urls become https, is it necessary to then update the sitemap to reflect the new protocol or will this be handled by the url rewrites?

Thank you kindly in advance!

4 Answers 4

  1. Yes, just changing the unsecure base URL to https is fine.
  2. I haven't looked at other FPC solutions, but our solution, Evolved Caching works equally well both on secure and insecure connections (and supports Varnish). I'm sure there are also other CE FPC solutions which also support SSL (perhaps even free ones though you would have to look). Although Varnish does not currently support SSL and there are no plans to add support, you can still use Varnish with SSL by using a reverse proxy such as Pound so you may want to investigate that as an option.
  3. No you don't need to make any changes to the sitemap generation if using secure pages, the URL's which appear in the sitemap are all still built using the base URL, so if that changes to https, the sitemap URL's will reflect that.
  • Just finished converting - visitors seem to be staying longer which is what I suspected might happen. Really appreciate your answer. SR
    – SR_Magento
    Commented Nov 17, 2014 at 13:23
  • Does Magento automatically redirect the unsecure URL to secure one? Just thinking in SEO perspective.
    – Webninja
    Commented Jun 29, 2016 at 9:33
  • If you have your store configured to redirect to the base url then it should redirect from insecure to secure pages with a 302 redirect, BUT it will redirect to the homepage whatever page you access insecurely. Easy enough to customise this behaviour to redirect to a secure version of the same page however. Commented Jun 30, 2016 at 11:58

No idea about 3.

  1. but depending on your modules just setting the unsecure url might not be enough, but in most cases it is
  2. Magentos EE FPC doesn't work at all with https, but you can easily hack it, the problem is here:

    if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') {
        return false;

    I don't know whether other FPCs did the same wrong decission, but I hope not.

  • Thanks for the quick reply - I'm running on CE so unfortunately that work around doesn't apply to me but will definitely help someone else.
    – SR_Magento
    Commented Oct 26, 2014 at 10:22

You need to read this first:- http://www.elastera.com/blog/why-google-advice-on-https-will-screw-your-magento-site/

Don't just change for the sake of it.

  • Not changing for the sake of changing - want to take advantage of my EV SSL cert.
    – SR_Magento
    Commented Oct 26, 2014 at 10:25
  • Hi user15656 and welcome to MageOverflow. Link only answeres are discouraged here, so it would be great if you add a short summary of the post, for the time when the post is no longer accessable Commented Oct 26, 2014 at 10:35

I know you are on Magento CE, for those using Magento EE here is a simple & ready to use extension to make Magento EE Full Page Cache work with HTTPS:


Make sure your Page Load Time is not visibly slowed down. You can use WebPage Test http://www.webpagetest.org/, which shows the SSL Negotiation time in the waterfall diagram. SSL requires an handshake, which has an impact on the overall response time. This problem becomes bigger when using many third party scripts.

What do you think is a more important ranking factor right now? Speed or Secure connection? A question to think of if you see a meaningful degradation in performance.

Depending on the complexity of your site and infrastructure, such a change can have several ramification. An EV SSL certificate costs around $200, so make sure you put things in perspective.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.