SSL and HTTPS for Merchant Center: what has to be secure

HTTPS with a valid certificate, at least on checkout, and in practice everywhere. Google’s “Checkout requirements and best practices” page says “you must secure your checkout with a valid SSL certificate” and must protect payments, transactions and all personally identifiable information, such as name, email, physical address and payment details. Third-party payment options must be HTTPS-secure too, and must not ask for personal data the payment doesn’t need. The Shopping ads policy on irresponsible data collection gives, as its example of unsafe collection, taking names, addresses, phone numbers or card numbers over a page that is not SSL protected. Most stores have a certificate. The trouble is the one that quietly expired. Check four things: it hasn’t expired and renews automatically; it covers every hostname you use, bare domain and www included; every http:// address redirects permanently to https://; and no HTTPS page pulls images or scripts over plain HTTP, which browsers treat as not fully secure. Use https:// in the product links you send to Merchant Center as well.

Google's “Checkout requirements and best practices” page puts it as a requirement: “To protect your customers, you must secure your checkout with a valid SSL certificate. Specifically, you must protect payments, transactions, and all personally identifiable information (such as name, email, physical address, and payment details).” It adds that third-party payment options must be “HTTPS-secure” and must not ask for personal information the payment does not need.

The Shopping ads policy on irresponsible data collection gives the other half. Its example of unsafe collection is taking names, addresses, phone numbers or card numbers “over an unsecured page which is not SSL protected and without a valid certificate”. And “Building trust with your customers” asks you to “Install an SSL certificate so customers know that their sensitive data is retrieved and stored securely”, and to “Ensure a secure checkout process.”

In practice the failure is rarely a store with no certificate at all. It is a certificate that expired when automatic renewal quietly stopped, one that covers www but not the bare domain, a checkout step or payment page on another domain, or mixed content: a page served over HTTPS that still pulls an image or script over plain HTTP, which browsers treat as not fully secure.

The free scan flags a certificate the browser cannot verify, a checkout page not served over HTTPS, and HTTPS pages that load images or scripts over plain HTTP, in one pass. Certificates lapse quietly; SSL expiry covers renewals. See every checkout check on the misrepresentation checker.