"Display nonsecure items" warning

Support & Bugs
1

Hi All

I have Piwik installed in Zen Cart, in the tpl_footer.php for the template. Although the tracking is working great I noticed that we haven’t gotten any orders since I installed Piwik.

Finally a customer phone call told me the problem: in IE they are getting the “This page contains both secure and nonsecure items. Do you want to display the nonsecure items?” dialog box when they start the checkout process. I tested it myself in IE 7: the warning appears as soon as the site goes to https. Without the Piwik code the warning does not appear. So basically, our customers using IE see that warning and run screaming from the room.

Is there something I should know about Piwik and secure pages? I have Piwik installed on several other Zen Sites and it seems fine there, just this single one is screwy. Of course it would be on the site that gets the most traffic and orders!

I’m going to look for a place to stick it that doesn’t show on https pages, but if anyone has a clue about this I’d appreciate some advice.

Thanks, and Happy Holidays

–Pat

2

Hi,
I created a test page on https://piwik.org/test-ssl.html

piwik.org doens’t have a valid SSL certificate, but once the absence of certificate validated, you can see that the Piwik tracking code is properly called in HTTPS.

What was your Piwik JS tag that you used?
It should look like:

<!-- Piwik -->
<a href="http://piwik.org" title="Analytics software" onclick="window.open(this.href);return(false);">
<script type="text/javascript">
var pkBaseURL = (("https:" == document.location.protocol) ? "https://piwik.org/demo/" : "http://piwik.org/demo/");
document.write(unescape("%3Cscript src='" + pkBaseURL + "piwik.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">

[.........]

Please update your Piwik JS tag if it doesn’t look like this. you can find your JS tag in Piwik > Settings > Site > show JS tag. happy new year!

3

Yes, the top part of the code is the same as what you posted. Here’s the whole block:

<!-- Piwik -->
<a href="http://piwik.org" title="Web analytics" onclick="window.open(this.href);return(false);">
<script type="text/javascript">
var pkBaseURL = (("https:" == document.location.protocol) ? "https://giggles.com/piwik/" : "http://giggles.com/piwik/");
document.write(unescape("%3Cscript src='" + pkBaseURL + "piwik.js' type='text/javascript'%3E%3C/script%3E"));
</script><script type="text/javascript">
piwik_action_name = '';
piwik_idsite = 1;
piwik_url = pkBaseURL + "piwik.php";
piwik_log(piwik_action_name, piwik_idsite, piwik_url);
</script>
<object><noscript><p>Web analytics <img src="http://giggles.com/piwik/piwik.php?idsite=1" style="border:0" alt=""/></p></noscript></object></a>
<!-- End Piwik Tag -->
4

[quote=matthieu @ Jan 12 2009, 04:09 AM]Hi,
I created a test page on https://piwik.org/test-ssl.html[/quote]

OK, I tested that link. FF is fine, no probs. Unfortunately the majority of our visitors are in IE, many of those are still in IE 6. Using IE version 7.0.5730.13 I get the security error page when I clicked your link. On my website I just get the secure/nonsecure items popup but the link you sent directs to a page with the following message

Page title is "Certificate Error - Navigation Blocked"
There is a problem with this website's security certificate. 
    
 The security certificate presented by this website was not issued by a trusted certificate authority.
The security certificate presented by this website has expired or is not yet valid.
The security certificate presented by this website was issued for a different website's address.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.  
  We recommend that you close this webpage and do not continue to this website.  
  Click here to close this webpage.  
  Continue to this website (not recommended).  
     More information
5

Pat, do you still encounter the problem? If yes, please contact us at hello@piwik.org fore more debugging, as we would really like to find out what the issue is. thanks

6

Hi

I’ve been off on a slew of other projects the past few months, but I’m back now! We’re on a new host and I just installed Piwik again.
During my hiatus I came across this solution for a different script and it works for Piwik too.

I put this in the header. It prevents the Piwik code from running on SSL so I no longer have the secure/nonsecure errors.

<?php if ($request_type == 'NONSSL') { ?>
. . . Piwik code or any script . . .
<?php } ?>

I installed Piwik on a couple Zen Carts, right before the tag in html_header.php. This broke one of the sites, was fine on the other one. So I moved the code up in the file so it was the 2nd or 3rd script executed and now it works. Go figure.

7

With the legacy piwik.js tracking code, putting it in the is a bad idea. First of all, it’s not a valid place for the tag (the transparent 1x1 pixel or web bug). Second, it means your outlink tracking won’t work.

8

Our users just reported they are getting the “This page contains both secure and nonsecure items. Do you want to display the nonsecure items?” dialog box when they go our website. We also found that we don’t have this message for Firefox users.
One recommendation was to change from https to http. Is this the only solution? is there a better solution?

9

If you use the standard javascript code as is, or the asynchronous version, http://piwik.org/docs/javascript-tracking/#toc-asynchronous-tracking

Then it should work fine on SSL and non SSL sites.

10

Thanks for confirming about Piwik JS code.
We found that our problem was with self-signed security certificate. Once we replaced it with CA signed certificate, we saw the big surge in web traffic reported by Piwik.