WP eStore and Payment Gateway: HTTPS insecure connection via Firefox and Safari

[kayjohns]

I have recently changed my website from HTTP to HTTPS, but I’m getting security errors in FireFox and Safari when I click the Buy Now buttons on the following pages:

[https://www.soothingyoursoul.com/7-7-formula-happy-life/]

I believe the problem is a combination of factors as follows:

BUY NOW BUTTON (submits form: <form action=”http://1.XXXXXX.pay.clickbank.net/&#8221; method=”post”>)

…throws the following errors in Firefox and Safari because URL is not https:

Firefox: Security Warning. The information you have entered on this page will be sent over an insecure connection and could be read by a third party. Are you sure you want to send this information? Continue/Send

Safari: This is a non-secure form. The form will be sent in a way that is not secure. Are you sure you want to send it? Cancel/Send

URL REDIRECT [http://1.XXXXXX.pay.clickbank.net] —>

ORDER FORM [https://ssl.clickbank.net/order/orderform.html]

The actual order form is secure. It is the redirect URL that is not secure but it cannot be changed. The reason it throws the security error is because that URL doesn’t exist on the ClickBank site so there is no security certificate for it.

Since the URL created by the Buy Now button using my ClickBank ID cannot be changed, the only part in the process that can be changed is the Buy Now button code.

The Buy Now button code is generated by both WP eStore and WP Payment Gateway plugins working together, so can you please confirm if there is some other way to create the buttons so they don’t submit a form when clicked but will still log the sale into my WP eStore system.

I’d appreciate any help you can give.

Many thanks

[wpCommerce]

Hi, We made some changes to the payment gateway bundle addon to get around this issue. I have sent a copy to your registered email address for testing. Let me know if you don’t receive it.

[rastarman]

I have a similar issue, apparently only with Firefox.

The browser does NOT show the site is insecure, but the GoDaddy security certificate does not show.

“http://&#8221; rather than “https://&#8221; shows only in the following code:

<!– WP eStore plugin v8.0.5 – http://www.tipsandtricks-hq.com/wordpress-estore-plugin-complete-solution-to-sell-digital-products-from-your-wordpress-blog-securely-1059/ –>

<script type=”text/javascript”>

JS_WP_ESTORE_CURRENCY_SYMBOL = “$”;

JS_WP_ESTORE_VARIATION_ADD_STRING = “+”;

JS_WP_ESTORE_VARIATION_DECIMAL_SEPERATOR = “.”;

JS_WP_ESTORE_VARIATION_THOUSAND_SEPERATOR = “,”;

JS_WP_ESTORE_VARIATION_CURRENCY_POS = “left”;

JS_WP_ESTORE_VARIATION_NUM_OF_DECIMALS = “2”;

JS_WP_ESTORE_MINIMUM_PRICE_YOU_CAN_ENTER = “The minimum amount you can specify is “;

JS_WP_ESTORE_URL = “https://athensjff.org/wp-content/plugins/wp-cart-for-digital-products&#8221;;

JS_WP_ESTORE_SELECT_OPTION_STRING = “Select Option”;

JS_WP_ESTORE_SELECT_OPTION_ERROR_MSG = “You need to select an option before you can proceed.”;</script><script type=”text/javascript” src=”//athensjff.org/wp-content/plugins/wp-cart-for-digital-products/lib/eStore_read_form.js?ver=8.0.5″></script><meta name=”viewport” content=”width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0″ /><link rel=”shortcut icon” href=”https://athensjff.org/wp-content/uploads/2017/10/athensjff-favicon.ico&#8221; />

<!– WP Custom CSS Plugin – http://www.tipsandtricks-hq.com/wordpress-custom-css-plugin-6413 –>

The seal does not display on any page with estore html.

One affected url is: athensjff.org/tickets-passes/

Thanks. Overall, a wonderful product I’ve been using for years.

[wzp]

I do not experience any issues, displaying the GoDaddy “verification” seal/certificate. Firefox Quantum 62.0.3 (64-bit).

[rastarman]

Actually, I just realized that to see the certificate in Chrome (Mac), I need to be in “Incognito.” When regular browser mode, it doesn’t show.

On my Mac, in Firefox, it doesn’t show in either mode.

In Safari, it does show in either mode.

At any rate, it doesn’t seem to be critical – I am not aware of any lost sales over the 3 years I’ve been running the site. In fact, sales have tripled in those 3 years, using only WP eStore and, of course, my brilliance.

[wzp]

To see it, you just click the GoDaddy seal at the bottom of the page, and it appears as a popup; irregardless of what mode you are using the browser in.

At any rate, it doesn’t seem to be critical – I am not aware of any lost sales over the 3 years I’ve been running the site.

Probably because… “nobody really cares” about if your site is verified/certified. You could probably get away with just having a bunch of official looking security logos at the bottom of the page, and nobody will challenge them, LOL & IMHO.

[admin]

Thank you. I will update those URLs in the plugin.

[Author]

Posts