Browser says “Not secure”: how to fix your online shop

Look to the left of the web address for a security icon or the words “Not secure”. Click it for a short explanation of how the browser rates the connection, then check how the address starts:

• http:// (no “s”). The shop opens over an unencrypted connection: there is no certificate, or no redirect to https://.
• https://, but a certificate warning. The certificate has expired, does not cover this address, or the certificate chain is incomplete.
• https:// and no certificate warning, yet the security icon still flags a problem. Check for mixed content (see below).

Check the home page, a product page and the cart, with and without “www”; the problem may affect only one.

An SSL certificate (HTTPS) lets a site use an encrypted connection: it ties the site's address to an encryption key. Your hosting provider installs it, or you do in the hosting control panel; the shop software (OpenCart or WordPress) does not.

• Expired. A certificate is valid for a limited time and has to be renewed in good time. Ask your provider whether renewal is automatic.
• Wrong address. One certificate can cover several addresses. If the address with “www” (or without it) is not on the list, that address shows a warning.
• Incomplete chain. The server has to send an intermediate certificate along with its own. Without it, some browsers may show an error while others look fine.

For the certificate itself, contact your hosting provider and tell them what the browser shows. I change the shop’s settings and the site addresses so that pages open over https://.

Then check for mixed content. The page opens over https://, but some files (images, stylesheets, scripts, fonts) still load over http://. Browsers try to upgrade image, audio and video requests to https:// by themselves, but block other files such as scripts, stylesheets and fonts. The shop can then look broken, or the cart can stop working.

How to find the insecure files (Chrome)

1. Open the page and start the developer tools: on Windows or Linux press F12 or Ctrl+Shift+I, on a Mac press Cmd+Option+I.
2. Reload the page and look at the “Issues” and “Console” tabs for mixed-content entries (“Mixed content”) that name an http:// address. If you cannot see the Issues tab, open it from “More tools” > “Issues”.
3. Note where each address comes from, such as a theme file (logo, background, font), a module or a product description with an image pasted in, and correct it there.

There is also a temporary workaround: the upgrade-insecure-requests directive, added by the server (in a Content-Security-Policy header) or by the page itself (in a meta tag), tells the browser to request insecure files over https:// instead. It does not change the address itself: a file missing at the https:// address still fails to load, and the browser does not fall back to http://.

This section applies to OpenCart 1.5.6, 2.3 and 3.0; in other versions (for example 2.2) the files and settings may differ. The address is set in two places:

• The config.php files. There are two: one in the site root and one in admin/. The root file holds HTTP_SERVER and HTTPS_SERVER; the admin one also holds HTTP_CATALOG and HTTPS_CATALOG. If the shop was installed over http://, HTTPS_SERVER may still start with http://. The main shop then puts an http:// base address (<base href>) and http:// product image addresses into pages opened over https://, so relative links to images and stylesheets load insecurely. Every address whose name starts with HTTPS_ should start with https:// and end with a slash (/).
• The “Use SSL” setting. It is under System > Settings, on the store's edit page, on the “Server” tab. In 1.5 it decides whether the shop uses the SSL address for its links. Standard 2.3 and 3.0 code does not read it, so there config.php alone sets the address. OpenCart's own help text says to check with your host that a certificate is installed and to add the SSL address to the shop and admin config files.

Make a backup copy of any file before changing it; a wrong address can break the shop and its admin panel, so if you are unsure, leave it alone.

Under Settings > General, the “WordPress Address (URL)” and “Site Address (URL)” fields should start with https://. If those addresses are set in wp-config.php (WP_HOME and WP_SITEURL), you cannot change them on the settings page. Changing these fields does not rewrite old http:// addresses already saved in page and product content; those have to be found and corrected separately.

If “Not secure” is still there after these checks, or you would rather not edit the shop’s settings files (config.php), contact me. I review the shop and set out in writing what the problem is and what I would do. The check is free. I make a backup of the whole site and its database first and test changes in a test copy while your shop keeps running.

Example: e.segris.lt, an old OpenCart 1.5 shop. I gave it a new look for phones and computers, set up its secure connection (SSL, HTTPS) and added Lithuanian product descriptions.

If “Not secure” came with a system error, see fixing online store errors; if the shop is old and you are wary of updating it, see how I upgrade OpenCart to a newer version.