2

I have just set up https on my store and it's active when I visit the customer login and checkout pages. Is it important to make other pages on my site use https// such as the homepage and product/cateogory pages? Right now the site directs to the ordinary www. instead of https// on those pages.

Thanks as always. :)

3

There are only a few pages configured to use https. the ones where the user has to enter personal information.
If you want everything to be on https the you need to set the base unsercure url to https://mysite.com.

| improve this answer | |
  • Are there benefits to having everything on https? And is it common for e-commerce stores to do this? – Billy Hudson Nov 20 '14 at 15:54
  • 1
    Not really. At least I don't know any of the benefits. It's important to have https on the pages there the customer fills in his information. That's it. – Marius Nov 20 '14 at 15:59
  • I'm not sure if this is entirely relevant in this stack exchange, but you might want to check security.stackexchange.com/questions/258/…. – daboross Nov 20 '14 at 18:50
2

https is only important when you are sending secured information 'across the wire' that is, personal information, login information, pricing information, perhaps location information (which is nice), or even correspondences -- such as a 'thank you for X purchase customer Z' if you want to be extra secure (although all this carries some overhead).

| improve this answer | |
2

I would quesiton what is the benefit of NOT running everything over HTTPS? Naturally people would prefer their online shopping to be as secure and confidential as possible.

Actually you cannot even make the transition from HTTP to HTTPS site securely, because a "Man In The Middle" could replace those with ordinary links and capture their login credentials (Google sslstrip for details).

Personally I don't trust any online stores if their front page is not HTTPS by default, and even less so if the HTTPS URL does not work at all.

| improve this answer | |
  • The one thing that I can think of is that CDNs can't cache HTTPS content as easily. – Ross Aiken Nov 20 '14 at 21:16
  • 1
    @RossAiken: That's not true, CDN can provide caching for HTTPS content, since those CDN is operated by you, you just need to install your certificates in the CDN. What you can't do with HTTPS is utilize client side caching proxies, since these caching proxies are owned by the user's ISP/company/university instead of by you, you can't just install your certificates there. – Lie Ryan Nov 20 '14 at 22:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.