Zen Cart SSL & HTTPS Mixed Content Errors

After installing an SSL certificate, many Zen Cart store owners find their browser still shows a padlock with a warning, or the URL still shows http://. This is almost always a configuration issue, not a certificate issue — and it's fixable without touching your server.

Understanding mixed content

A "mixed content" error occurs when your page is served over HTTPS but one or more resources on the page (an image, a script, a stylesheet) is loaded over plain HTTP. Modern browsers block or warn about this because a single HTTP resource can compromise the security of an otherwise secure page.

Zen Cart stores can have mixed content from several sources:

• The configure.php files still pointing to http://
• Product images uploaded with HTTP URLs in the database
• Third-party scripts (analytics, chat widgets) loaded over HTTP
• CSS or JS files referenced in templates with hardcoded HTTP URLs
• Older Zen Cart modules that hardcode HTTP URLs

Fix 1 — Update configure.php to HTTPS

This is the most important fix. Zen Cart's configure.php files define the base URLs for your store — if they point to HTTP, everything loads over HTTP regardless of your SSL certificate.

You have two configure.php files that both need updating:

• /includes/configure.php — front-end store
• /admin/includes/configure.php — admin panel

In both files, find and update these lines:

// Change this (HTTP):
define('HTTP_SERVER', 'http://www.yourstore.com');
define('HTTPS_SERVER', 'http://www.yourstore.com');

// To this (HTTPS):
define('HTTP_SERVER', 'https://www.yourstore.com');
define('HTTPS_SERVER', 'https://www.yourstore.com');

Fix 2 — Force HTTPS via .htaccess

Even after updating configure.php, direct HTTP visits to your store won't automatically redirect to HTTPS. Add these lines to your .htaccess file in the Zen Cart root to force all traffic to HTTPS:

# Force HTTPS redirect
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

If you already have a RewriteEngine On line in your .htaccess, don't add another one — just insert the two RewriteCond/RewriteRule lines directly below it.

Fix 3 — Set ENABLE_SSL in configure.php

Zen Cart has a dedicated SSL enable flag in configure.php. Check that it is set to true in both configure.php files:

// Should be true, not false:
define('ENABLE_SSL', true);
define('ENABLE_SSL_CATALOG', true);

If these constants don't exist in your configure.php (common in older Zen Cart versions), add them.

Fix 4 — Find and fix mixed content URLs

Even with configure.php correct, mixed content warnings can persist if your templates or modules reference HTTP URLs directly. Use your browser's developer tools to find them:

Useful tool: Why No Padlock

Visit whynopadlock.com and enter your store URL. It will scan your page and list every mixed content resource, making it much faster to identify all HTTP URLs at once.

Fix 5 — SSL certificate issues

If you've updated configure.php and fixed mixed content but still see a browser warning, the SSL certificate itself may be the problem. Common certificate issues:

• Expired certificate — Check the expiry date in your browser by clicking the padlock. Most free Let's Encrypt certificates expire every 90 days.
• Wrong domain — Your certificate must cover the exact domain in your URL. A certificate for yourstore.com doesn't cover www.yourstore.com unless it's a wildcard or SAN certificate.
• Missing intermediate certificate — Some SSL providers require you to install an intermediate (chain) certificate alongside the main certificate. If it's missing, some browsers will show a warning.
• Self-signed certificate — Self-signed certificates always produce browser warnings. You need a certificate from a trusted Certificate Authority (CA). Let's Encrypt is free and trusted by all major browsers.

Fix 6 — HTTP URLs stored in the database

Product images and other content URLs are sometimes stored directly in the database with http:// prefixes. This is common if you migrated from HTTP to HTTPS after products were already entered, or if you imported products with absolute URLs.

You can find and replace these using phpMyAdmin:

-- Find products with HTTP image URLs:
SELECT products_id, products_image
FROM products
WHERE products_image LIKE 'http://%';

-- Replace HTTP with HTTPS in product images:
UPDATE products
SET products_image = REPLACE(products_image, 'http://www.yourstore.com', 'https://www.yourstore.com')
WHERE products_image LIKE 'http://www.yourstore.com%';

Run a SELECT first to see what will be affected before running the UPDATE. If you're not comfortable with SQL, we can do this safely for you — see below.

Verifying the fix

After making changes, verify your store is fully secure:

1. Visit your store and confirm the browser padlock is solid (no warnings)
2. Browse several pages: homepage, a category, a product page, the cart, and checkout
3. Check the SSL Labs report again — aim for an A rating
4. Run WhyNoPadlock on your homepage to confirm no remaining mixed content
5. Test that HTTP URLs redirect to HTTPS (visit http://yourstore.com and confirm it redirects)