OpenCart requires updating both the store's admin settings and its configuration files to properly enforce HTTPS — missing either half is a common cause of a half-migrated store.
Steps
- In System → Settings → Server, set "Use SSL" to Yes and confirm the HTTPS URL field is correct.
- Update
config.phpandadmin/config.php, changingHTTP_SERVERandHTTP_CATALOGvalues to theirhttps://equivalents. - Add a server-level redirect (.htaccess for Apache, server block for Nginx) so requests to the old http:// URLs are redirected rather than just left broken.
Test both the storefront and the separate admin panel after making changes — it's easy to update one and forget the other, since OpenCart maintains separate config files for each.
Why OpenCart's separate admin and storefront configs both need updating
OpenCart maintains distinct configuration files for its public storefront and its admin panel, each with independent HTTP_SERVER and HTTPS_SERVER settings — updating only one half means either the storefront or the admin area continues generating incorrect protocol links, so both config.php files need the same update applied.
What extensions commonly store their own hardcoded URL settings in OpenCart
Payment and shipping extensions in OpenCart frequently store a callback or return URL in their own individual settings screen within the extension configuration, separate from the core config files — checking each active extension's settings after migration catches URLs the core configuration change wouldn't touch.
Why testing both the storefront and admin panel separately matters
Because OpenCart maintains genuinely separate configuration for its public storefront and admin area, confirming HTTPS works correctly requires testing both independently — a store that appears fully migrated on the customer-facing side can still have an admin panel serving mixed content or incorrect redirects if only one config file was updated.
What OpenCart's default theme versus a purchased theme means for this process
A store running a purchased, third-party OpenCart theme may have its own separate asset and configuration files with independent hardcoded URL assumptions beyond what the core OpenCart configuration files control — reviewing the specific theme's own documentation or code for any protocol-specific settings is worth doing alongside the core steps.
Why OpenCart's marketplace extensions vary widely in HTTPS readiness
Extensions purchased from OpenCart's marketplace range considerably in code quality and maintenance status, meaning some older or less actively maintained extensions may still generate hardcoded http:// links internally — testing each active extension's output specifically after migration catches this inconsistency across your installed extension set.
What testing a full order flow end to end actually verifies
Placing an actual test order through your payment gateway's sandbox mode, from product page through checkout to order confirmation, confirms every step in the transaction flow correctly uses HTTPS throughout — a more thorough verification than checking individual pages in isolation, since it surfaces issues that only appear in the connected sequence.
A final comparison point against more fully managed alternatives
OpenCart's self-hosted flexibility comes with meaningfully more manual HTTPS configuration responsibility compared to the fully managed platforms covered elsewhere in this category — a reasonable trade-off for the platform's greater customization freedom, but worth being clear-eyed about before assuming it involves the same zero-configuration experience as a managed alternative.
What a fresh OpenCart installation's default HTTPS state actually is
A newly installed OpenCart store defaults to HTTP-only configuration with SSL settings disabled, requiring the manual steps covered in this guide to be completed explicitly — HTTPS isn't enabled or assumed by default the way it is on some newer, more opinionated platforms.
How this guide's steps differ for OpenCart 2.x versus more current 3.x and 4.x versions
The underlying config.php-based approach covered in this guide applies across OpenCart's major versions, though newer 3.x and 4.x releases have refined admin panel navigation for the relevant settings — the core configuration file edits remain fundamentally the same across versions.