> ## Documentation Index > Fetch the complete documentation index at: https://docs.vortexiq.ai/llms.txt > Use this file to discover all available pages before exploring further. # SSL / HTTPS Status, WooCommerce > Whether the site forces HTTPS. No-SSL means consumer keys + customer PII fly in plaintext on every REST call, direct PCI/GDPR exposure. Top... How to read... **Metrics type:** [Key Metrics](/nerve-centre/overview#metrics-types-explained) • **Category:** [Ecommerce Platform](/nerve-centre/connectors#connectors-by-type) > Whether the site forces HTTPS. No-SSL means consumer keys + customer PII fly in plaintext on every REST call, direct PCI/GDPR exposure. Top-3 audit (WC03). ## At a glance > Real-time check that the WooCommerce store forces HTTPS. No-SSL means consumer keys and customer PII fly in plaintext on every REST call, a direct PCI / GDPR exposure. | | | | --------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **What it counts** | Boolean: `force_ssl_checkout = true AND site_url starts with 'https://' AND certificate is valid AND not expiring within 14 days`. | | **REST API endpoint** | `GET /wp-json/wp/v2/settings` plus a TLS handshake against `siteurl` to verify cert chain. | | **VAT / tax / shipping / discounts** | Not applicable. | | **Status filter** | All states evaluated together. Any failure flips the card to "at risk". | | **Refunds / cancelled / failed orders** | Not applicable. | | **Currency** | Not applicable. | | **Channels / sources** | Affects entire storefront. | | **Self-hosted vs managed-Woo** | **Self-hosted is the high-risk profile.** Self-hosted Woo on cheap shared hosting may use auto-issued Let's Encrypt certs that fail to renew. Managed-Woo (Pressable, WP Engine, Kinsta) auto-renews and almost never trips this card. WordPress.com handles SSL transparently. | | **Time window** | `RT` (polled hourly) | | **Alert trigger** | `force_ssl=false OR site_url not https OR cert expiring <14d`; sentiment\_key `stack_health` | | **Roles** | owner, operations, finance | ## Calculation Calculated automatically from your WooCommerce data. See the At a glance summary above for what the metric tracks and the worked example below for a typical reading. ## Worked example A self-hosted UK fashion brand on Bluehost shared hosting. Polled 12 Apr 26. | Check | Status | Note | | -------------------------------- | ------ | -------------------------------------------------- | | `siteurl` starts with `https://` | Yes | | | `force_ssl_checkout` is true | No | **Setting was reset after a recent plugin update** | | Cert chain valid | Yes | Let's Encrypt R3 | | Cert expiry > 14 days | 8 days | **Auto-renewal failing** | The card flips to "at risk" with two findings: force-SSL disabled, cert expiring in 8 days. Three observations: 1. **Self-hosted variance is the recurring theme.** Bluehost's Let's Encrypt auto-renew has a known intermittent failure mode where the renewal cron does not run if the host throttled the merchant for resource use. This brand has tripped the renewal failure twice in 6 months. Managed-Woo hosts (Pressable, Kinsta) operate their own renewal pipeline and rarely fail. 2. **Plugin-induced data shape variance: `force_ssl_checkout` reset.** A WooCommerce update in early April migrated some legacy settings, including `force_ssl_checkout` for stores that had it set via constants in `wp-config.php`. The setting silently flipped to false on dozens of stores. This card caught it within an hour of the next poll. 3. **Customer impact is non-obvious.** With `force_ssl_checkout` off, the checkout page still loads over HTTPS for users typing the full URL, but customers landing on `http://` versions of product pages stay on HTTP through checkout, exposing card data on the wire. This is a PCI compliance breach that does not trigger any user-visible browser warning until the form posts. ## Sibling cards merchants should reference together | Card | Why pair it with SSL Status | | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------- | | [WC Plugins Outdated](/nerve-centre/kpi-cards/woocommerce/plugins-out-of-date) | Stack-health companion. Stores with bad SSL also tend to have outdated plugins. | | [WC Plugin Security Breach Alert](/nerve-centre/kpi-cards/woocommerce/plugin-security-patch-breach) | The "skimmer attack" precondition pair: bad SSL plus unpatched plugin. | | [WC WC Core Version](/nerve-centre/kpi-cards/woocommerce/woocommerce-core-version) | WC settings can reset SSL flags on major version updates. | | [Website Performance Security Headers](/nerve-centre/website_performance/security_headers) | Cross-cutting cert / HSTS / CSP view. | ## Reconciling against the vendor's own dashboard **Where to look in WordPress / WooCommerce Admin:** [WP Admin → Settings → General](/wp-admin/options-general.php) for `siteurl`. [WP Admin → WooCommerce → Settings → Advanced → Page setup → Force secure checkout](/wp-admin/admin.php?page=wc-settings\&tab=advanced). Cert details typically need a separate tool (host control panel or `openssl s_client`). **Why our finding may differ from WP Admin:** | Reason | Direction | | ------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------- | | **Time-zone**. Cert expiry is UTC; WP Admin may display in WP-site timezone. | Could shift by 0-1 day at the boundary | | **Self-hosted server uptime**. TLS handshake fails during host outage; alert may fire then auto-clear. | Self-resolves | | **Plugin-version compatibility**. Some "Really Simple SSL" or "WP Force SSL" plugins override `force_ssl_checkout` at runtime. | We read the canonical setting; plugins may mask the issue at runtime but not at config | | **Currency plugin behaviour**. Not relevant. | n/a | **Cross-connector reconciliation:** | Card | Expected relationship | | -------------------------------------------------------------------------------- | ------------------------------------------------------------------------- | | [`website.security_headers`](/nerve-centre/website_performance/security_headers) | A failing SSL state usually shows up here as missing HSTS or weak cipher. | ***
Same-metric documentation cross-reference This is a Woo-specific stack-health card. Shopify and BigCommerce manage SSL on the merchant's behalf, so no equivalent merchant-action card exists.
## Known limitations / merchant FAQs **Self-hosted vs managed-Woo, why does it matter?** Self-hosted owns SSL renewal end-to-end. Auto-renewal on cheap shared hosting can fail silently. Managed-Woo handles SSL transparently. **Status-filter selection, why include cert expiry?** A 14-day expiry warning gives the merchant time to act. Beyond 14 days the issue is severity-low; under 14 days it is high-severity (cert expiry breaks the entire site instantly). **Refund-object accounting?** Not applicable. **Plugin-induced data shape variance?** "Really Simple SSL" and "WP Force SSL" plugins rewrite HTTP to HTTPS at runtime via output buffering. These mask `force_ssl_checkout = false` from the customer's perspective but not from the configuration. An attacker bypassing the plugin (e.g. via a direct `wp-cron.php` call) would still expose plaintext data. Vortex IQ flags the underlying config, not the runtime override. **Multi-currency, does it affect SSL?** No, currency-independent. **Why does Woo and Stripe disagree?** Stripe does not measure SSL. They only verify that webhook URLs are HTTPS. **Today is jumpy, why?** Stable. The card flips on / off discretely on configuration change or cert expiry. **Sync-lag from self-hosted server slowness?** Hourly poll. Cert expiry detection runs on the polled value; brief outages mean detection is up to 1 hour late, not a problem for a 14-day countdown. **My WP Admin shows SSL is fine, why is the alert firing?** 1. Verify `force_ssl_checkout` in WC Settings. 2. Check cert expiry directly: `openssl s_client -connect yourdomain.com:443 -servername yourdomain.com | openssl x509 -noout -dates`. 3. If using a Really Simple SSL plugin, disable it temporarily and check whether the site still loads on HTTPS, the plugin may be masking a real config gap. 4. If genuinely fine, contact support. *** ### Tracked live in Vortex IQ Nerve Centre *SSL / HTTPS Status* is one of hundreds of KPI pulses Vortex IQ tracks across WooCommerce and 70+ other ecommerce connectors. Nerve Centre runs the detection layer; Vortex Mind investigates the cause when something moves; Ask Viq lets you interrogate any number in plain English. [Start for free](https://app.vortexiq.ai/login) or [book a demo](https://www.vortexiq.ai/contact-us) to see this metric running on your own data.