Securing your checkout page

When taking credit card payments, pages should be secured with HTTPS connections. CartThrob makes it very simple to accomplish this. In addition to what CartThrob can do, you also need to take steps to secure the content on your site, or your page won’t be secure, and to your client’s distress will not show a “lock” or other “secured” icon.

Securing a page with HTTPS requires the following

1. You have a commonly accepted secure certificate setup for your site. If you purchase one from any standard issuing authority, most browsers will recognize your certificate and accept it. If you were trying to use your own self-signed certificate to save money… this is going to fail. If you try to use https:// without a properly installed secure certificate, your page will fail to load. We buy ours through Namecheap for $15 / year.

2. Your checkout page url should be called with https://

3. All embedded files be accessed via an https:// connection. This includes javascript, css (and images in your css file), images, and any other embedded file. You can link to non https:// pages, but to fully secure the page, you need to also secure all of your embedded files. It’s pretty common for people to miss some. Common errors that will keep your page running in http:// mode include embedding a script host without using https://, embedding tracking javascript in the footer of your page without https://, using background images or sprites in css, and linking to them using http://. You do not need to change your ExpressionEngine {embed}s but you need to change any standard HTML embed to use an https:// connection.

   Usually the best, most flexible option is to simply call files relatively (without using http:// or https://). For instance call a script like /scripts/store.js rather than https://yoursite.com/scripts/store.js. If you embed files using relative links, the browser will use whichever method your page uses (http:// or https://)

4. Secure your forms. Add the following parameter to ANY cartthrob form secure_action="yes" and the form will submit securely.

The benefits of securing your page include the encryption of data as it’s being submitted to forms throughout your site, so that it can be read by any outside user. You can secure any page you wish… even every page on your site. Encryption will slow down the page load however, so most opt to only secure pages as needed.

AJAX posts from a CartThrob form do not follow the return= redirect. They stay on the current page and receive JSON (or injected HTML). That current page still needs to be HTTPS, along with every script it loads. See Ajax.