Encrypt the whole site
Every page — not just checkout — should load over https. Redirect all http to https and eliminate mixed content so the padlock never drops.
A single http image or script can break the padlock on an otherwise secure page — hunt down mixed content.
HSTS for extra safety
An HSTS header tells browsers to only ever use https for your site, closing a small window attackers can exploit.
It tells the browser to refuse plain http for your site entirely, so an attacker can't downgrade the first connection before the redirect kicks in.