Need Help?
Activate SSL for your Shopify Store

Blog

Helping You Succeed
View Details

Activate SSL for your Shopify Store

March 13th, 2018

Shopify has set up FREE 256-bit SSL certificates for all pages, content, and data on all eligible Shopify sites! SSL is industry standard security technology for establishing an encrypted link between a web server and a web browser, ensuring that the data that passes between them remains private. SSL changes the URLs on your site from “HTTP” to “HTTPS”. For example, if your store’s URL is http://www.boutique.com, it will be updated to https://www.boutique.com after you activate SSL certificates.

Just so you know, SSL certificates are already activated by default in Shopify for your store’s checkout, and for any content that’s hosted on your .myshopify.com domain. The new change we’re announcing here is that SSL is now available site-wide.

Having SSL certificates on your storefront lets you:

  • Improve your site’s security by using HTTPS instead of HTTP.
  • Build customer trust by displaying the SSL padlock icon beside your online storefront’s URL.
  • Improve your search engine rankings, since SSL is now a ranking factor to Google.
  • Take a step further in becoming PCI compliant.

If your online storefront displays content (including images, videos, or web fonts) that are hosted somewhere other than Shopify, then you can verify it on the Domains settings page in your Shopify admin to make sure it doesn’t invalidate your storefront’s SSL certificate.

 

HOW TO ACTIVATE YOUR SSL CERTIFICATE

If your Shopify store is eligible for SSL certificates, you’ll receive a notification on your Shopify Home:

After you activate your SSL certificate, we highly recommend updating your domain’s sitemap using Google Webmaster Tools. Google essentially just needs to be notified that your URLs have changed from HTTP to HTTPS. Shopify is gradually rolling out SSL certificates. Your site may not have the option for SSL quite yet. Be sure to check your site often, as the option should be available to you in a matter of time.

Other than activating it on your Shopify Home, here is the alternative way to activate your SSL certificate:

1.     From your Shopify admin, click Online Store, then click Domains (or press G W D):

2.     In the SSL certificates section, click Activate SSL certificates. This adds SSL certification to all eligible pages on your online store:

Activating your SSL certificates can take anywhere from a few minutes to a couple of hours. Your site will remain online and functional during that time. If your activation is successful, you’ll see a confirmation on the Domains page in your Shopify admin:

3.     If any pages or files can’t be given SSL certificates automatically, then you need to update them manually, and then click Retry SSL certificate activation:

SSL certificates work only on pages whose content — including images, videos, and other assets like .JS or .CSS files — is published exclusively using HTTPS instead of HTTP.

 

HOW TO UPDATE YOUR DOMAIN’S SITEMAP

Activating SSL certificates for your domain can temporarily affect your website’s organic traffic. If you’re using webmaster tools to manage your website (like Google Webmaster Tools), then you can manually update your domain’s sitemap and notify search engines immediately when your storefront URLs change from HTTP to HTTPS. This process is different depending on the webmaster tools that you use, but we highly recommend using Google Webmaster Tools, at the very least.

 

Google Webmaster Tools

This example shows how to update your domain’s sitemap using Google Webmaster Tools. If you haven’t already, be sure to verify your Shopify domain first. To update your domain’s sitemap using Google Webmaster Tools:

1.     Log in to your Google Webmaster Tools account.

2.     From the Search Console, enter your domain (including the prefix HTTPS://), and then click ADD PROPERTY.

3.     Click on the name of the domain that’s been encrypted using SSL

4.     Go to Crawl – Sitemaps

5.     Click ADD/TEST SITEMAP

6.     Enter your domain’s new HTTPS sitemap (for example: https://www.your-shopify-domain.com/sitemap.xml).

7.     Remove your domain’s HTTP sitemap from its profile.

 

Fix mixed content errors

Content that’s displayed on your Shopify website but that is hosted externally (including images, web forms, or videos that are hosted on a domain without an SSL certificate) can’t be automatically updated to HTTPS when you activate SSL certificates for your custom domains in Shopify. Pages that contain unencrypted content cause mixed content errors. Pages with mixed content errors will still be visible, but they won’t display a padlock icon and an https:// URL in the browser. In some cases, web browsers will block unsecured content or display an error when they open a webpage that doesn’t have a valid SSL certificate. This can result in less trust from your site’s visitors, and/or pages and page content that does not display correctly.

 

Change filenames from HTTP to HTTPS

If any of the content on your online store can’t be updated automatically when you activate SSL certificates in your Shopify admin, then you might need to update it manually. For some content types, you’ll need to edit the source HTML so that the path is set to HTTPS instead of HTTP. After you make changes, test the new versions to make sure that your content displays properly. If it doesn’t, then the host might not support HTTPS, and you should consider moving your content to a recommended host.

 

Move unsecured content to Shopify

In some cases, you can fix mixed content errors is by hosting unsecured content at Shopify instead of using a third-party provider. To move content from an unsecured host to Shopify :

1.     From your Shopify admin, click Online Store, then click Domains (or press G W D):

2.     In the SSL certificates section, click the unencrypted URLs link to view a list of the files that are causing mixed content errors:

3.     Copy the URL of a file that’s causing a mixed content error:

4.     Paste the URL in your browser and then press enter.

5.     From your browser, download the file to your computer

6.     Upload the file to Shopify.

7.     After you’ve successfully uploaded the file, copy its new, Shopify-hosted URL

8.     From your Shopify admin, open the page that contains the original version of the file that’s causing a mixed content error.

9.     In the rich text editor, find the file’s original URL.

10.    Replace the file’s original URL with the new, Shopify-hosted URL. Make sure that it begins with //.

11.     Save your changes.

12.    On the Domains settings page in your Shopify admin, click Retry SSL certificate activation:

Did you know?

After you activate SSL certificates, notifications on your Shopify Home will let you know if you create new pages that include mixed content errors.

 

BEST PRACTICES FOR SSL CONTENT

There are a few things you can do to make sure your Shopify store’s content stays secure:

  • Host all of your online store’s content on Shopify or a server that publishes over HTTPS.
  • Host your video content on a service that publishes over HTTPS
  • If you’re using web fonts (such as Google fonts), make sure they’re published over HTTPS from their source

Need help? Contact Us today! 

Back to Blog