1. The Mals return link should have https selected (under Cart Setup > return link)
2. The Mals remote http link should have HTTPS POST selected
3. Under mals cart setup > messages and general settings the checkbox for SECURE PAGE FOR NAME AND ADDRESS should be checked.
4. If used, the thumbnails URL should begin with https