Should I used "http" or "https" for my Base Site URL/iframe parameters?
Always use the secure site "https". You can manually add the "s" to your Base Site URL if it needs updating. Also, for production instances, make sure the Site Base URL on the Merchant Facility contains ....secure.force.com...
Also make sure these check boxes are ticked on your site as well.
