Many storeowners are uncertain whether they should add SSL to their site, citing various reasons, including cost and complexity of setup.
Here are the things to consider:
WHY USE SSL?
SSL encrypts communications between your customer's browser and your webserver. This means nobody can snoop on what they're transmitting to you (such as someone spying on internet traffic in a cafe or wifi hotspot, or library)
HOW DOES ZEN CART IMPLEMENT MY SSL?
If you have SSL enabled in your hosting account (that's something you arrange with your hosting company directly), then you can tell Zen Cart to use your SSL URL ... and then Zen Cart will automatically use that SSL URL when presenting pages dealing with sensitive information like login, account-creation, password changes, checkout, and even your admin pages.
Zen Cart will not use SSL on pages that don't deal with sensitive information (such as a customer browsing your available products), since SSL isn't needed there. It will intelligently use SSL only on sensitive pages.
DO I NEED SSL?
If your site is collecting credit card info directly in a page inside your store (ie: not redirecting to a bank or payment gateway site to collect card info for payment) then YES you absolutely MUST use SSL to protect your customers' payment information.
BUT MY PAYMENTS HAPPEN OFFSITE.
If your payment-collection is ALWAYS handled offsite via another gateway that uses SSL on its site, then *your* site does not "technically" require SSL insomuch as it's not handling credit card details. BUT ... if you don't have SSL enabled on your site then some spy could still steal your customers' passwords and names and addresses and email addresses when they fill in various fields on your store's site. They could then use that information to login to their accounts and impersonate them. While they couldn't make purchases using their private banking/creditcard data (since ZC doesn't store any banking/card data), they could request a cancellation of an order, or initiate communications with you under the customer's name while not actually being the customer, etc.
So, if you added SSL to your site then you would prevent the ability for such identity theft.
BUT SSL COSTS MONEY
Yes, there are typically 3 costs associated with SSL:
1. Dedicated IP address
2. Certificate itself (A dedicated certificate specific to your site is recommended. A shared certificate might work.)
3. Installation/activation of the certificate in your hosting account
WHY A DEDICATED IP ADDRESS?
Your hosting account needs to be able to offer SSL. At a minimum this typically means you'll need a plan that offers a dedicated IP address. Many plans include this for free, or offer it for a couple dollars per month.
(Aside: While the industry is just now starting to offer the ability to do SSL without requiring a dedicated IP address, this technology is in its infancy and not all browsers are smart enough to support it yet, so it may be a couple years before this becomes mainstream. In the meantime the cost of a dedicated IP cannot be avoided.)
DEDICATED OR SHARED?
A dedicated certificate is strongly recommended, both for branding and technical reasons. A dedicated certificate will use the same URL as your store does, thus branding it the same as your store. No confusion to customers. Also, a dedicated certificate will work out-of-the-box with no special setup required beyond the basics. Simply tell Zen Cart the SSL URL and flip the enable-ssl setting on and you're done.
While it's possible to use a shared certificate, this can be confusing to your customers when the URL of your store suddenly changes to your hosting company's URL when on protected pages. This becomes a branding/identity issue. Plus sometimes shared certificates are configured in very weird ways with some cheaper-cost hosting companies, and cannot be made to work with the industry standards embraced by Zen Cart (specifically if the shared-SSL server/certificate is on a separate server from where your actual store's files are located). But a shared certificate could let you run multiple stores from one IP address, if you didn't care about the branding issue.
HOW DO I INSTALL A CERTIFICATE?
Installing an SSL certificate is a subject specific to your hosting account. Work with your hosting company or follow their FAQ documentation to buy and install an SSL certificate in your hosting account.
Then make sure you can visit your site using your SSL URL without getting server errors.
And then you can tell Zen Cart to use your new SSL URL. See the FAQ below for that part.
Further Related Reading:
http://www.zen-cart.com/content.php?...o-i-enable-ssl
http://www.zen-cart.com/content.php?...-i-disable-ssl
http://www.zen-cart.com/content.php?...sl-certificate
- 104 Users Found This Useful
Related Articles
How can I find out what version of Zen Cart or PHP or MySQL I'm using?
To find out what version of Zen Cart or PHP or MySQL you are currently using, you can simply go...
Getting a BLANK PAGE? Here's the answer ...
If you're getting a blank page when trying to browse to a certain page on your store, or after...
What's New in the Upcoming v2.0 release?
Database Abstraction Layer and Sql CacheThe abstraction layer has been re-factored to include a...
Image Preparation - How-to
I've seen several posts where people obviously aren't quite sure about the best way to set up...
Some tips to modify stylesheet
1. Download Web Developer extension for FireFox here2. Install & restart FireFox. You should...
