How do you encrypt the backend and checkout in Magento? By selecting the appropriate setting in the backend under System->Configuration->GENERAL->Web->Secure. But how do you also encrypt all remaining pages? By entering the secure Base URL under System->Configuration->GENERAL->Web->Unsecure as well. Yesss, that easy, right! Unfortunately, not with existing Magento installations. What is the problem here? All unsecured subpages indexed by search engines (i.e. pages served using the http protocol) are now redirected to the homepage.
So, what is the better approach here?
First, we redirect all requests to the server to https:// via .htaccess, for example using
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Unfortunately, we then still need to make some adjustments, because there are some links on the various pages that need to be updated (e.g. the coupon link in the shopping cart, the "Add to cart" button on the product detail page, the contact form, etc.).
We can now secure these areas easily with a small module based on the Secure Cart Extension by Fishpig. For this, we only need a config.xml, for example in
app/code/local/Econcess/CartSecure/etc/,
which can then look something like this (the individual sections are mostly self-explanatory; "monkey" refers to the newsletter section in the customer account that is provided by "MailChimp":
<?xml version="1.0"?>
<config>
<modules>
<Econcess_CartSecure />
</modules>
<frontend>
<secure_url>
<catalog_product>/catalog/product</catalog_product>
<checkout_cart>/checkout/cart</checkout_cart>
<checkout>/checkout/cart</checkout>
<checkout_cart_add>/checkout/cart/add</checkout_cart_add>
<contacts>/contacts</contacts>
<tag>/tag</tag>
<monkey>/monkey</monkey>
</secure_url>
</frontend>
</config>
The module then only needs to be activated using the file named Econcess_CartSecure.xml in our example, located in
app/etc/modules/,
which can then look like this:
<?xml version="1.0"?>
<config>
<modules>
<Econcess_CartSecure>
<active>true</active>
<codePool>local</codePool>
</Econcess_CartSecure>
</modules>
</config>
That makes everything work as it should. Tested with Magento 1.8.0.0.
