Introduction
Modern payment gateways expect HTTPS on checkout and often on the whole site. If any asset loads over HTTP, browsers may show mixed content warnings; wallet buttons (Apple Pay, Google Pay) may refuse to initialize. Customers interpret that as untrustworthy—even when the gateway itself is fine.
This guide is for WooCommerce store owners and agencies. It is not a substitute for your host’s SSL documentation or your processor’s domain allowlist requirements.
For broader configuration mistakes, see common WooCommerce payment gateway mistakes.
Why this matters for payments: Card iframes, wallet buttons, and some 3-D Secure flows require a secure context. Mixed HTTP assets can break scripts silently—customers blame “your checkout,” not a single image URL.
1. Force HTTPS at WordPress level
In Settings → General, both WordPress Address and Site Address should use https://. If they disagree, you will get redirect loops or partial SSL—fix canonical host consistency (your team may use redirects documented in your server setup).
2. Mixed content: find and fix
Symptom: Padlock broken; console shows Mixed Content blocking scripts or images.
Fix: Update theme options, widgets, and hardcoded http:// links to https:// or protocol-relative where appropriate. Use a search-replace on a staging clone for bulk fixes—never blind-replace production without backup.
3. Reverse proxy and Cloudflare
If you use Cloudflare or another proxy:
- SSL mode should be Full or Full (strict) with a valid origin certificate.
- Page Rules should not cache checkout or cart aggressively.
4. Security plugins and firewalls
Some WAF rules block legitimate gateway callbacks. If webhooks fail only from the processor’s IPs, whitelist per official documentation—not guesswork.
5. Payment method UI
Some gateways embed iframes or scripts that require secure contexts. After SSL is clean, retest Blocks and classic checkout.
6. Still stuck?
- Confirm PHP and Woo versions per your gateway plugin readme.
- Open a ticket with hosting (TLS chain) and gateway support (domain allowlist) with HAR or console logs—redact secrets.
PatSaTECH: plugin support · malware / broken site help when compromise is suspected.
7. Regression testing after SSL fixes
After you change URLs, proxies, or caching:
- Run one sandbox payment per payment method (card, wallet if enabled).
- Confirm webhook or IPN still updates order status—see webhook monitoring.
- Re-check mobile Safari and Chrome; TLS issues often appear on one engine only.
Document the test date in your runbook so the next theme update does not skip the same checks.
Related reading
- WooCommerce payment gateway integration checklist
- How 3-D Secure 2.0 improves customer trust
- Custom payment gateway integration
