IE warning mixed secure and insecure

How do I clear this warning/

[scott1137]

Owner decided she wanted online forms for uploading confidential information in her Joomla site. Bought certificates, put site in secure folder in shared linux server. htaccess redirect to folder. All works. Except the warning in IE.

Cleaned up links using Xenu's Link Sleuth as guide. Only http links are outgoing to some community partners and to the form's developer.

I understand from an earlier post [webmasterworld.com ] that it could be hardwired calls to http in the html.

This is my first time through moving a site to secure. How do I clear this warning?

tia,

Scott

[Rugles]

Any chance its some pictures that are the cause?
Maybe from another website that are displayed on your site.

[scott1137]

Thanks. Could be. The community partner links are logos I set links to. Two of those the link checker labeled as 'redirects'.

I meant to mention that. What are redirects in this context? I set the links up by copying from their sites. So I took the logo image file and paired it with the link.

The other images on the site are stock photos.

I have just been screening for http links.

Plan check images to see if links - not sure how to do this beyond looking at image properties. Suggestions welcome.

Will also trial & error by taking down images one at a time, starting with partner logos labeled as redirects.

Also someone suggested maybe a some pixels may be incoming. How would I check for this?

Other suggestions?

[ssgumby]

Simply view source on the page and search for http:// you will find your culprit

[scott1137]

Thank you. Just did that: easy (duh):only http: on that page were the outbound links mentioned and the doctype.

Would it be possible ie could check the whole site for mixed content and not just the page that is loading?

[enigma1]

Bought certificates, put site in secure folder in shared linux server. htaccess redirect to folder

So now you have the whole site in https, as joomla doesn't support different domains for secure, non-secure. That's gonna be slow

For the secure warnings, apart of the images you should check jscripts. See if there is code that pulls in images from them.

[rocknbil]

put site in secure folder in shared linux server.

This was your mistake, I think. If you're using Plesk or some other CP, there will be an option, "house all secure content in a single directory." You want this option off. This will make life a lot easier. This way, all pages and objects can be served from the same location, over https or http.

The second thing you should do is learn to use relative paths. Instead of

<img src="http: // example.com/images/logo.jpg">

do this

<img src="/images/logo.jpg">

The leading slash is important. Consider

index.html
products/index.html
products/widgets/index.html
products/widgets/green/index.html

width dot slash syntax, you have this nightmare

src="images/logo.jpg"
src="../images/logo.jpg"
src="../../images/logo.jpg"
src="../../../images/logo.jpg"

Using the leading slash will always start from the domain root and you have one path for all pages:

src="/images/logo.jpg"

How this relates to security warnings: Doesn't matter whether it's http or https, this approach will request the resource over the appropriate protocol.

Last, once you correct the secure directory issue, if you're still getting warnings, right click the page in FireFox and View Page Info. hit the media tab. This will show you where the non-secure items are.

An often overlooked item is the secure/non/secure code in Google Analytics, or a link to the non secure version of install in a Flash object code.

[scott1137]

enigma1: thanks for the tip on jscript.

Both: I copied all the files and folders into the secure folder. The host doesn't have the "house all secure content..." option.

Would I just go back to using the public folder? How? There is an ssl redirect plugin. Would I use that?

As I wrote earlier this is first time through with this.