RSTY

I just “launched” a newsletter service for a site on which I work, which relies on some SSL enabled pages for registration, logging in, and that kind of thing. Corporate policy is that any sensitive personal data must be encrypted. Once the new functionality had been rolled out, I was greeted with a “the page you are about to view contains secure and non secure items, do you want to continue?”.

Now, obviously, Joe User is used to clicking “no” to anything he doesn’t understand, so we can’t leave these warnings to appear even if the non secure items are harmless - we can’t expect users to know that or decide for themselves.

The non secure item on our page was a Google Analytics tag which looked like this:

<script src=“http://www.google-analytics.com/urchin.js” type=“text/javascript”>

Which, as you can see, is not transferred over a secure connection. Instead, you have to use:

<script src=“https://ssl.google-analytics.com/urchin.js” type=“text/javascript”>

As you might expect, my first try was to just change http:// to https://, but actually you need to change it to ssl. from www.