I'm trying to add comments as reviews to a store using the Devdemon Ratings module.

The store runs over SSL and that's all fine, however when I add a comment:form to the mix, the form action isn't secure and therefore the SSL on the page throws out an insecure error.

Securing forms on the rest of the site is easy, but I cannot find any example or anything in the documentation that explains how to secure comment forms. Is this possible or am I missing something?


    {if rating:not_rated}
        <a href="javascript:void(0);" title="Write Review" id="id_{entry_id}_review" class="review"><i class="fa fa-star"></i></a>


Any fixes or workarounds appreciated!


  • Is your base url in the expression engine admin panel "http" or "https"?
    – Edd Aslin
    Oct 14, 2014 at 11:02
  • That does actually fix it, the URL is http currently. However, I'm not running the site via HTTPS everywhere - only where it's needed such as an account page or the online store. Any workarounds to this?
    – Raf
    Oct 14, 2014 at 19:05
  • The cleanest way to do it would probably be to create a PHP plugin that alters or replaces the base url dependant on the current page. The quick and dirty way would be to use JS / jQuery to alter the forms post URL after page load replacing http with https on the required pages.
    – Edd Aslin
    Oct 14, 2014 at 19:12
  • Ah, that's a shame. I tried the JS method as a quick-fix but the page still reported a SSL error, even though the script loaded first. I guess I'll have to source someone to get that script made. Shame the comment:form doesn't support secure modes. Thanks for the help, I really appreciate it!
    – Raf
    Oct 14, 2014 at 20:16

1 Answer 1


Brad from DevDemon was kind enough to provide some suggestions and this has in fact led to a solution.


By modifying the config file you can have the URLs set dynamically and thereby all content within a page can load over SSL by default, or not, depending on how the page itself it loaded.

The simplest solution Edd posted above is to have your site running on HTTPS in the EE admin config. If this isn't an option (as was my case), then a dynamic config file will do the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.