Why do I have both HTTPS and HTTP links on site, need them all secure!

I am getting th开发者_如何学Goe security alert: "You are about to be directed to a connection that is not secure. the information you are sending to the current site might be transmitted to a non-secure site. Do you wish to continue?" when I try to login as a customer on my clients oscommerce website. I noticed the link in the status bar goes from a https prefix to a nonsecure http prefix. The site has a SSL certificate, so how do I ensure the entire store portion of the site directs to the secured site?

---

It is likely that some parts of the page, most often images or scripts, are loaded non-secure. You'll need to go through them in the browser's "view page source" view one by one and eliminate the reason (most often, a configuration setting pointing to http://).

Some external tools like Google Analytics that you may be embedding on your site can be included through https://, some don't. In that case, you may have to remove those tools from your secure site.

If you can't switch all the settings, try using relative paths

<img src="/images/shop/xyz.gif">

but the first thing is to identify the non-secure elements using the source code view of your browser.

An immediate redirection from a https:// page to a http:/ one would not result in a warning as you describe. Can you specify what's up with that?

---

Use Fiddler and browse your site, in the listing it should become evident what is using HTTP and HTTPS.

---

Ensure that the following are included over https:

• css files
• js files
• embedded media (images, videos)

If you're confident none of your own stuff is included over http, check things like tracking pixels and other third-party gadgets.

Edit: Now that you've linked your page, I see that your <base> tag is the problem:

<base href="http://balancedecosolutions.com/products//catalog/"> 

Change to:

<base href="https://balancedecosolutions.com/products//catalog/"> 

---

If the suggestion from Pekka doesn't suit your needs you can try using relative links based on the schema (http or https):

e.g.,

<a href="//www.example.com/mypage.html">I am a 100% valid link!</a>

The only problem with this technique is that it doesn't work with CSS files in all browsers; though it does work within Javascript and inline CSS. (I could be wrong here; anyone want to check?).

e.g., the following :

<link rel="stylesheet" href="/css/mycss.css" />
<!-- mycss.css contents: -->
...
body{
    background-image:url(//static.example.com/background.png);
}
...

...might fail.

A simple Find/Replace on your source code could be easy.

---

It sounds to me like the HTML form you are submitting is hardcoded to post to a non-secure page.