I have built a new Shopify site for a client, and since I cut over DNS, I learned that there was a forwarding redirect set up for the old site to drive traffic from HTTP to HTTPS.

Now that we've migrated to Shopify, the site is no longer hosted with SSL until you get to the checkout page.

The problem is that when repeat visitors have the HTTPS URL in their auto-fill history in the address bar, they attempt navigating to the site, but they are navigating to the HTTPS URL, and since Shopify has no SSL until you reach checkout, every browser gives a warning of malicious intent by hackers.

Any ideas?

I've tried forwarding from HTTPS to HTTP, but that hasn't done anything as of yet.

  • 2
    You will only be able to forward HTTPS to HTTP (in htaccess) if your site accepts requests on HTTPS, which it doesn't. I imagine it's not just repeat visitors that have the URL in their history, but also search engines that have indexed the HTTPS URLs (unless you preemptively set up a redirect before removing the old SSL)? I guess you'll need to follow the same procedure as for changing domains (except without the redirection unfortunately), inform Google in GWT and similar for the other search engines.
    – MrWhite
    Commented Oct 18, 2014 at 19:16
  • +1: interesting question but likely no solution.
    – William
    Commented Oct 18, 2014 at 19:18
  • Or maybe not... -1 for cross-posting: stackoverflow.com/questions/26436282/…
    – William
    Commented Oct 18, 2014 at 19:18
  • 1
    @WilliamDavidEdwards Thanks for helping to monitor the site. New users most likely don't realize cross-posting isn't condoned on different SE sites, so a welcome comment with a link to this Meta question usually helps point this out without alienating them, and a flag helps us know so we can close it if it's better suited on another site. In this case, it's better suited here than SO, as was suggested to the OP before they posted it here.
    – dan
    Commented Oct 19, 2014 at 0:33
  • Hey guys - sorry for the cross post. I have been a LONGTIME SO user but had absolutely no idea about the crossposting no-no's on SE sites. Anyway, thanks for the answers and info. Good to know! Commented Oct 27, 2014 at 4:14

1 Answer 1


If Shopify allows you to change your nameservers then Cloudflare may work. I haven't tried for Shopify but CF has a free SSL as a proxy. It works on "flexible" mode even if the origin is in HTTP mode. Turn on "authenticated origin pulls" to help compensate for this HTTP origin. We do this all the time with sites that shouldn't be allowed to run HTTPS.

Now, the issue may be that Shopify doesn't understand SSL mode. If this is the case, first start by forcing HTTPS with a page rule. If you are still getting warnings in console (or things not loading), then try looking in your theme resources for insecure assets. Make them all relative. Then go through any WYSIWYG data and other areas where routes are exposed to do the same thing. If you're lucky things will work. If not, at least you can suppress the insecure warning and allow them to connect to Shopify before you swap them back to HTTP mode :)

Oh, if your client had HSTS set, you can do a 0 second cache time to disable it and "reset" any browsers with HSTS (307 redirect) in cache still.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.