Can Marketo forms be embedded on https pages?

[Anonymous]

Our web people are switching our website to https pages (instead of http) and all of our asset download forms have disappeared.

Anyone know of any restrictions?

Thanks,

Erica

[SanfordWhiteman]

Marketo forms work just fine on secure pages, assuming you're using the default embed code.

What doesn't work is if for some reason you're embedding entire Marketo LPs as IFRAMEs in your site, and your LP domain isn't set up w/SSL at Marketo (n.b. this costs $ to add to your subscription). This isn't a Marketo restriction, it's a browser security measure that applies to all IFRAMEs.

[Anonymous]

I've encountered a similar issue where our site is https, but when I try to embed a form using the provided code, I get a "Failed to load resource: net::ERR_INSECURE_RESPONSE" error in Chrome. I'm not trying to embed a LP, just the form.

[SanfordWhiteman]

Please provide your URL so I can inspect your case.

[Ayan_Talukder]

Hi Sanford,

Have a very similar question. Here is an example:

Creating ArcGIS Open Data Sites in 60 Minutes (or Less) | Esri Canada

The form loads without an issue, however you can see the site becomes "not secure". We've had clients tell us the form information doesn't get submitted because of their internal security settings and haven't found a way around this.

Marketo support told us to use our own CNAME in the form embed code. We were doing this before our security certificate was renewed and the forms started to disappear so I've gone back to using the original Marketo form embed code.

Any suggestions? Thanks a lot!

[SanfordWhiteman]

We've had clients tell us the form information doesn't get submitted because of their internal security settings and haven't found a way around this.

There are several mixed content warnings on the page, but the one that's related to the form has only to do with the fancy select image (the blue arrow). That isn't preventing the form from being submitted. Have you been testing this? In what browser is the mixed content blocking the form?

so I've gone back to using the original Marketo form embed code.

Good idea.

[Ayan_Talukder]

Thanks for the reply Sanford. This issue has been going on for us for about 6 months. Marketo couldn't figure out what it was and suggested to change the CNAME. It looks like that isn't working if the website is secure now.

We've been testing the forms internally but we have never been able to reproduce the issue consistently. We did an eblast for our webinar yesterday and received roughly about 10 individuals who said the form wasn't being submitted. I suspect it could be more and unfortunately people may not realize it. We have been saking clients to let us know what browsers they are using, and we've received an array of responses (IE, Firefox, Chrome) and most users are on Windows 7.

We are thinking about upgrading to the https landing pages and iFraming those but it is definitely not the most ideal method.

[SanfordWhiteman]

IFRAMEing has only disadvantages and if you're seeing unexpected mixed content warnings that won't fix 'em.

Are you aware that you posted the link to the plaintext version of your site?  Is it possible that you're relying on redirection to the SSL version of your site, but that step not working correctly (i.e. redirecting to an statically cached older version or something along those lines)? I ask this specifically because I saw one mixed content warning because /forms.min.js attempted to load over plaintext -- but it was securely loading (from //app-ab04.marketo.com) in the source the next time I refreshed!

[Anonymous]

Sorry, it's only available on an internal network.

The script is standard:

<script src="//dev.amazonappservices.com/js/forms2/js/forms2.min.js"></script>

<form id="mktoForm_560"></form>

<script>MktoForms2.loadForm("//dev.amazonappservices.com", "070-JMM-398", 560);</script>

[SanfordWhiteman]

See this thread from just yesterday: Turning on Https - munchkin issues , landing page issues?

[Anonymous]

Thanks.

I'm not a Marketo user, just a content guy who's trying to figure out how to get the form into our page. It's not self-evident to me, as I'm not familiar with landing pages, forms, etc.

I just created a new form in Marketo, approved it and brought up the embed code. The code (same as what I pasted above) is what I was given. So, I guess that's not the default? I understand what you're saying, but I'm working with a form, not a landing page, as far as I can tell. I don't understand why it would give me the LP domain if it's a form...

[SanfordWhiteman]

I mean it's self-evident in the sense that the browser error (ERR_INSECURE_RESPONSE) and the fact that https://dev.amazonappservices.com doesn't have a cert installed (you can test it in your browser) make it clear that including the script from that domain won't work.

It'd be the same for any <script src="//something.example.com"> when it's loaded from http​s://www.example.com (or https​://another.example.net) while something.example.com doesn't have a matching cert.

dev.amazonappservices.com is your primary LP domain (there's no such thing as a special form domain) but it shouldn't be inserted into in your embed code unless you have an SSL cert paid for, uploaded to Marketo, and installed by Marketo's engineering team. Maybe that process is currently in progress, but If they've jumped the gun and changed your instance to use that domain without it actually being able to work, that's really bad. I sure hope they haven't pushed this change to other instances without thinking it through.

You'll be able to load the form if you use your instance //app-ab09.marketo.com, as demonstrated here: https://codepen.io/figureone/pen/63e5cc4236663a4e04d23988fefd6d13

[Anonymous]

I'll have our email peeps look into the account and see why it's defaulting to the LP domain. At the very least, we definitely need to get the cert set up.

Replacing the domain with "app-ab09.marketo.com" worked. Thanks again for your help!

[SanfordWhiteman]

This is self-evidently broken: you're trying to load from your LP domain over https:// but your Marketo instance doesn't have a cert.

The default embed code loads from //<instance>.marketo.com, which has a matching cert.