3

I have a client who wants to accept Authorize.net donations on their website. We only have a need for one page to be secured for our purposes. I've put a lot of research into this and it seems that the Wordpress HTTPS plugin would be the best option, with the least amount of brain damage. However, I see that the plugin has not been updated in three years. Multiple forums and blogs say that it is still safe to use, but I want to know if anyone has/is currently using this plugin for similar purposes and if they have any advice for me before I go down this road? Thank you!

closed as off-topic by TheDeadMedic, Mark Kaplun, Mayeenul Islam, Howdy_McGee, cybmeta Jun 2 '16 at 9:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • Thanks so much guys! I should have made it more clear that I already have an SSL Certificate. Just need to make sure it applies to only one page. Thank you! – Denver Ethos May 17 '16 at 20:26
2

If you are looking to use HTTPS, I reccomend following this wordpress guide: https://make.wordpress.org/support/user-manual/web-publishing/https-for-wordpress/#implementing-https-for-wordpress

You can get a free SSL Certificate from: https://letsencrypt.org/ If you find difficulty setting it up, you can often pay your host a small fee to help set this up. Once set up, you just need to make sure all the links on the page are HTTPS and not HTTP. Really easy to fix with plugins like Velvet Blues URL.

The Wordpress HTTPS plugin just makes implementing the SSL a bit easier. I would discourage installing old plugins as they often have security flaws and can conflict with your theme / other plugins.

  • for the free SSL cert, it seem that you need root access right? letsencrypt.org/getting-started Not possible on shared hosting? – Carl Alberto May 17 '16 at 19:19
  • It depends on the host. I use Dreamhost for a bunch of stuff, and they've started offering free letsencrypt certificates as part of their services. Check with your host. – Pat J May 17 '16 at 19:21
  • Thank you! I should have specified that I already have an SSL certificate. Is there a step-by-step that can catch me up on this process? I understand the theory, just not quite the practice... – Denver Ethos May 17 '16 at 20:27
  • 1
    If you already have an SSL Certificate, I highly recommend this tutorial: css-tricks.com/moving-to-https-on-wordpress You basically need to ensure all elements are HTTPS and force your site to HTTPS. As I mentioned before, Velvet Blues URL is really good for fixing majority of your http:// . I normally replace all http:// with // which basically tells the browser to fetch whatever the site protocol is. Ie. if your wordpress sire URL is https:// it will fetch https:// Hope this helps! If your site is going to https:// but the padlock isn't appearing, its because you still have http: – jake May 18 '16 at 8:19
  • 1
    To find where the http:// elements are located (sometimes things are hardcoded in the dashboard and hard to spot, for example in your theme's custom css or gravity forms custom buttons, you can use whynopadlock.com – jake May 18 '16 at 8:26
0

Wordpress HTTPS doesn't solely secure the site. It just allows a page/pages/sections to be forced to HTTPs. You still need a certificate.

Our company uses Wordpress HTTPS in combination with an SSL certificate installed to the server. We also process through Authorize.net, and have not experienced issues (WP 4.4.2); though, we're still updating our theme to be compatible with 4.5.x.

  • Thank you! I'm already on 4.5.2 and haven't noticed any issues so far. I appreciate the input! – Denver Ethos May 17 '16 at 20:29
0

There is a Woocommerce setting to force SSL on the checkout page only. It's in Woocommerce > settings > checkout > Force secure checkout

As a side note, and someone correct me if I'm wrong on this, but I've recently heard that it actually doesn't matter if the page is loaded over https as the only connection that has to be a secure ssl connection is the one from the client's computer to authorize.net. Having the server send content to the user over https is just for show because everyone thinks this means their checkout is secure.

  • Huh. That's really interesting. I suppose it makes sense but I would love to hear more about this. Maybe I'll create a different thread for this topic. Thank you! – Denver Ethos May 18 '16 at 22:17

Not the answer you're looking for? Browse other questions tagged or ask your own question.