Hi Simon,
I replicated the problem. Its nothing to do with htpasswd so please ignore that suggestion.
The actual problem is that it appears some URLs are reporting back as https, eg. the admin-ajax.php is reporting back as the secured link. This means when the plugin goes to accept the offer it’s calling up the https version of the site and it throws a security error (you can see this reported back in the javascript console).
I recommend you run https across your whole site and redirect any non-http visits to the secure URL. Running both on your site will only cause problems, choose either secured or non-secured. This might be something you need to get your host/web developer to help with.
Hope this helps!
PS. You also have a JS error in the console. It’s to do with a link in your header from the google analytics tracking code.
https://snag.gy/wxWVDN.jpg
You probably need to update your google analytics plugin I’d say, they have a newer version. Likewise any extra tracking scripts (this looks like it might be part of the ecommerce tracking?).
Cheers,
Josh