HTTPS / SSL FAQ

• Do I need to use SSL on my payment pages?

  Yes. It is the responsible thing to do. The total cost of adding an SSL certificate is generally small ($10 for the certificate, $10-20 to install it). Your customers are becoming more savvy and are expecting a professionally experience at your site. Professionals use HTTPS on their payments pages.. In addition, Stripe recommends it.

• Forcing WordPress to load the page using HTTPS

  The payment forms are just normal WordPress pages/posts. The plugin doesn’t do anything special to force HTTPS on the initial load of these pages. It does force HTTPS on the AJAX JavaScript calls. To force HTTPS on the WordPress pages that contain payment forms, there are free WordPress plugins available. Here is a screenshot of the one that I use on diglabs.com.

  

  This plugin then adds a meta-box to every page that allows you to force HTTPS. Here is a screenshot of the metabox from one of my payment pages:

  

  The nice thing about these plugins is that they generally force HTTPS on all the other resources (images and other scripts) that the page loads.

• My Page Still Has In Secure Content

  When all resources (e.g. initial page, images, script files) are being loaded via HTTPS the browser will indicate to your customers that the page is secure. For example, on Chrome here is how the Dig Labs payment page looks:

  

  Sometimes after all these steps, your page is ‘partially secure’. This means that there are still resources that are being loaded on your page that are using HTTP instead of HTTPS. Here a couple of really nice services that tell you what on your page is still being loaded insecurely: Why No Padlock? and SSL Labs. Enter your URL and they will analyze your site and provide a list of resources that aren’t being loaded using HTTPS. This usually means that you will find a hardcoded URL that looks something like: http://mysite.com/imgs/img1.png. To fix this you will need to change that URL to https://mysite.com/imgs/img1.png (notice the ‘https’ instead of ‘http’).