Moving Checkout and Confirm Pages to SSL

I currently use Yahoo Web Hosting and I need some assistance with securing my shopping cart.

Yahoo offers the use of their own SSL certificate for Yahoo web hosting customers to secure any of their web pages. Yahoo requires that I create a separate SSL Folder in root folder to house all pages I wish to encrypt (this has already been done).

I would like to move my checkout and confirm eCart pages to my SSL folder; however, I am uncertain how this may impact the shopping cart and checkout process (such as one page communicating and redirecting to another).

Would you be able to assist me in determining what I need to do to ensure all my files will communicate and redirect properly?

Can you do a test try to call your index page with https:// instead of http:// and any other pages depending on the result i maby will be able to point you the way

the best strategy is to upload all pages to the HTTPS server, then use an htaccess rule top redirect all http traffic to the https server:
http-https-rewriterule-redirect.html

Jason, I have general understanding of what you are recommending. However, I need clarification on a couple of things:

1) When you stated to upload all pages, are you referring to all the pages that eCart created through the Checkout Wizard, such as, checkout, confirm pages, all error and success pages, etc.?

2) With respect to the htaccess rule...am I to copy and paste the code (given at the link provided) at the top of each eCart page? If not, how is the code to be applied?

Thank you!

1) No. By all pages, I am referring to the entire site.

2) On Apache servers, you can create a file named .htaccess to configure how the server processes page requests. the page I linked shows code to add to the .htaccess file that you create to tell the Apache server to forward any request to your site starting http:// to https://

Jason, can you please explain why I would need to upload all my root folders and files to my ssl folder (where Yahoo provide SSL encryption)? What is this accomplishing? Does this have to do with the .htaccess folder/file?

There are a couple reasons for doing it this way:
1) Personally, I find it a better shopping experience when I am on the secure https:// server from the start. It demonstrates to me that the store developer has my security in mind.

I am more willing to continue through adding items to the cart and check out if the entire process is behind the secure server.

2) Redirecting to the secure https:// server when going from the cart page to the checkout page, then ensuring that they are not directed back to the unsecure server at any time until the checkout has been processed takes a _lot_ more work and planning.

Jason, I appreciate your responses. I am finding your recommendation to move my entire root site to my SSL folder a bit hard to swallow. Please, I completely understand the need for my customers to experience a secure online shopping process. I am dead set to have my eCart pages under SSL encryption; however, to move my site would create too many issues with my website.

You may need to know that my site is not on a private server, but shared through Yahoo webhosting. Yahoo requires that anything I want to have encrypted or secured under an SSL, that all such files be moved to a SSL subdirectory within my root.

Is there any way that I can just move my eCart pages, such as my cart, checkout, confirm, and all other related files to my SSL subdirectory and edit the appropriate code to redirect to the encrypted eCart pages? If so and you feel that this would be a complicated process, could I request some of your time over the phone whereby you can provide some direction? You may find it helpful to see how I am actually set up on Yahoo's web server.

Applying SSL security to my eCart pages is extremely important to me and this is the only keeping me back before I can securely test my checkout process.

Thank you for your consideration!

Moving the site to the SSL server will not introduce the complications you are assuming, in actuality, it will simplify the process to have the site on the ssl server and redirect all traffic to the ssl server.

doing it the way I recommend, you only need to configure the htaccess rule.

If you insist on only having the checkout pages under the secure server, then see the "Applying SSL to your eCart checkout" tutorial on the eCart support page:
ecart/