Check that customers reach the correct shop domain over an encrypted connection, and distinguish certificate errors from insecure resources on the page.
This guide is for shop administrators in Abicart Go, Plus and Pro. HTTPS support is included in the platform. A custom domain must be connected correctly and its certificate must cover the exact hostname customers use. Starting a subscription does not prove that domain DNS and certificates already work.
1. Understand what HTTPS protects
SSL is the older everyday name; modern HTTPS connections use TLS. Encryption protects traffic between the browser and the server it connects to. It does not certify that every product statement is correct or that the shop is protected against every intrusion. Nor does it prove how data is stored in databases.
2. Check the correct domain
Open Settings → Domains and SEO and check that the correct custom domain is connected.
Check DNS using the instructions for connecting a domain. Also check whether customers use the name with and without www.
Open the intended public shop address using
https://. Read the browser's connection information for the exact hostname.Check that links and redirects lead to the intended HTTPS address.
Abicart manages certificates for connected custom domains when the prerequisites are met. Platform-assigned shop addresses are managed separately; do not order your own domain certificate for such an address. If using an older classic solution or another special domain configuration, check it before following a theme guide.
3. Read the browser warning
HTTPS addresses begin with https://. Connection information icons vary between browsers and versions; a padlock is not the only possible icon. The images below show older browser views, rather than a requirement for today's appearance.
Certificate error before the page opens: note the exact hostname and error code. Check the domain connection, DNS and certificate validity. Do not bypass the warning or ask customers to submit payment details over a failing connection.
Page opens with a mixed content warning: investigate images, scripts and other resources loaded over http. A valid page certificate does not make insecure external resources safe.
Wrong page or no page: check the domain connection and redirects before assuming it is only a certificate issue.
4. Correct insecure resources and external settings
Use a working HTTPS address for a trusted external resource. For your own images and files, upload an authorised copy under Appearance → File archive and update the link. Do not casually move an external service script to the file archive; it may need to run from the provider's own address. Check each actual warning in browser developer tools.
Also check that external services use the shop's correct HTTPS address. For GA4, check the web stream in the current Analytics administration. Older Universal Analytics instructions involving the middle property settings column do not apply to GA4.
If you suspect an intrusion
A working HTTPS certificate cannot determine whether a shop was affected by a particular security incident. Contact Abicart with the shop ID, affected address, time and actual observations. Do not share passwords or payment details. Use separate administrator accounts, protect their login and remove access no longer needed. Do not substitute an ordinary certificate change for investigating a suspected incident.
Quick start
Check the domain connection and DNS.
Open the correct HTTPS address and read its connection information.
Distinguish certificate errors from mixed content and incorrect redirects.
Correct the actual cause and recheck the page without warnings.
Subscription and domain
HTTPS support is included in Go, Plus and Pro. A custom domain needs a correct connection and a valid certificate for its name. HTTPS is one part of security, rather than a guarantee against all intrusions or a complete security certification.
