User Experience Stack Exchange is a question and answer site for user experience researchers and experts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a site where it's very difficult for me to add SSL, so I'm using a secure iframe on the payment page to collect credit card details.

Currently it's set up to appear like it's the same site. The only issue is that I obviously don't get the green bar, even though it's totally secure. I've put the word "secure" with a lock logo in the header.

How can I give the user a feeling of security and trust in this context?


First and foremost, thanks for your answers.

A little more context regarding why I'm using an iframe: I've got a site builder for ecommerce, and my customers get a subdomain of my domain and can also add their own domain on top of it. Custom domains are a majority, and there's no simple way for them to set up SSL.

I'm currently adding credit card support (I originally use PayPal) and wanted to make it transparent. In the option I'm currently using the iframe is hosted on my own domain so I can control the SSL there. From your answers, the alternative would be to actually redirect to my site for payment, similar to going to PayPal. I can make it clear that they'll be redirected to another site and I won't have to "fake" that the site is secure. The only caveat is that they actually leave the site, and I feel that at least my customers won't be happy about that.

share|improve this question

We've been telling people to look for the lock in the address bar and to mistrust anything that says it's secure but doesn't have the lock. Any way you look at it, it's going to look like you're phishing and no amount of design is going to help you with that.

That doesn't mean everything needs to be on SSL. Amazon isn't but takes you to a secure server for sign-on and payments. If you're just going to put SSL on the payment process, why don't you do this on a subdomain ( Announce you'll be doing so ("click continue to go to our secure payment server") to prevent any confusion. But you could make that totally seamless as well (again, look at Amazon). Around here everyone is totally accustomed to the payment process being separate and extra secure.

share|improve this answer
I would add to this that putting a lock logo on your own site should make a user feel less secure, as you're basically using all the tactics of a phisher. When you redirect to the payment provider, make sure that both pages refer to each other. Make sure you prepare the user for the switch to another page and make sure the other page shows that it's communicating with you (eg. it shows your logo andthe item they're paying for). – Peter Apr 10 '13 at 9:39
I concur with Peter. A common way to prepare the user for the switch is to use a "Pay with" button to transition to the payment processor. For example, a site using as their payment processor would use's "Pay Now \ Amazon Payments" button. Such images are provided by most payment processors and may foster trust by associating your payment process with a well-known brand. – Brian Apr 10 '13 at 13:04
Hey @Koen, thanks for the answer. I just edited my question to provide more context. – ben Apr 10 '13 at 16:04
If I understand correctly, the e-commerce site that will use your checkout feature could be on pretty much any (sub-)domain. I think the general point of my answer still stands: you have to make clear the payment is secure and you need to do that in a way people can confidently judge this security by themselves (ie. take them to a secure domain). The only real option I can think of is to present this just like any other payment provider (Mastercard secure card, Ogone, Buckaroo, Paypal): on its own domain. Perhaps my creativity fails me and there is another way? – Koen Lageveen Apr 10 '13 at 18:22

The only way to make your users feel secure is to implement SSL the right way. Having a lock icon along with secure anyone can do. If it's not secure, as in having implemented SSL the right way - don't try to fool your users that it is secure. That would only make things worse.

If your SSL fails, this screenshot may be what the users get in return. No way they will ever trust your site with credit card details again.

enter image description here

share|improve this answer

Text regarding mastercard/visa/paypal protection is a good (no, GREAT) way to begin, and in the context e-commerce, you want to avoid anything that could decrease your conversion rate.

If you're finding that many users are abandoning their shopping cart and you've identified that it is a trust issue, you may want to try reassuring them by providing a physical (retail?) presence, and some real-world contact information.

By exposing your real identity to real-world interactions, you bring the e-commerce out of the cloud and back into the physical world.

... At least, in their mind.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.