2

I've inherited a running, trading website and am trying to work through numerous issues with it, amongst them, that the secure site is pulling through a lot of unsecured content and links, seemingly with the unsecure_base_url setting.

I intend to scour the site to work out the issues, but in the interim is there any downside to using an https:// url in the unsecure_base_url field?

And if I want to enforce Secure Usage, would it be a valid permanent solution?

Any advice appreciated.

0

The only downside to using SSL on your frontend would be performance. However, with the right hardware, tuning and a good FPC, it isn't going to affect you as much as some would lead you to believe.

To work out the elements that are not SSL, you can use Why no pad lock? as a starting point.

Implementing https:// in unsecure_base_url effectively forces your site to be https and secure in the frontend.

1

Yes, you can set the unsecure URL to an "https" URL, and that will set Magento use SSL in all links, settings, etc...

However, there is more to this in terms of functionality, security issues, etc...

  1. You must insure that all third party links for JS, CSS, and/or images are also using https secure URLs. If not, then you'll get mixed content security issues.

  2. If you're using a CDN, you'll need to set up SSL on the CDN. You can use SNI or a 3rd party domain for the CDN to save money.

  3. You will get a small performance hit, but it's mostly a minor one. If you're thinking about SEO and Google, Google has stated they want to see secure URLs in the near future, and offer a small SEO boost for those sites that are fully secure: http://googlewebmastercentral.blogspot.com/2014/08/https-as-ranking-signal.html

  4. There have been a few issues with using all SSL pages and Magento Enterprise's Full Page Cache: https://github.com/elastera/EnterprisePageCacheSSL

  5. You should 301 redirect all non-SSL URLs on your site with code such as this in your .htaccess file (after the first "RewriteEngine On" line:

    RewriteCond %{HTTPS} off

    RewriteRule ^(.*) https://%{HTTP_HOST}/$1 [L,R=301]

As you can see, it can get a bit complicated, but may be worth it in terms of security and a possible small SEO boost.

  • Yup, I'm happy with the technical side but was a bit paranoid about Magento having a requirement for an unsecure option or anything like that! Thanks for your help! – Wren Jan 19 '15 at 7:09
1

You are right to be concerned and wanting to get some facts before jumping onto the SSL bandwagon. This is very true with Magento EE, as Rob rightly pointed out.

Here are few things to consider:

  • HTTPS for the whole site stops Magento Enterprise’s Full Page Cache from working.
  • Page Load Time will be slower, how much slower will depend on how your site is built, especially regarding third party scripts (they all need to be under HTTPS).
  • If you use CDN, depending which one, you might be hit by additional costs for having your own SSL certificate on the CDN. Ideally, when using HTTPS you would want.
  • Using SPDY to make your site more secure and faster!

You can find further details in this blog: Why Google’s advice on HTTPS will screw your Magento site

Good luck and please share your findings and experience with us!

  • That blog is completely exaggerated and is exactly what I was referring to in my answer. Just because its on the internet, doesn't make it true or law. Take everything with a grain of salt. I have SSL implemented and it wasn't THAT much of a performance hit. – SR_Magento Jan 19 '15 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.