I'm currently redirecting all requests to https. I've updated the siteUrl variable and all of my entry links have been correctly updated but the image links are still http.

When I go to the admin panel all of the CSS/JS files wont load because the site is trying to load them over HTTP instead of HTTPS.

server {

  listen   443;

  root /var/www/<url>/htdocs;
  index index.php index.html index.htm;

  ssl on;
  ssl_certificate /etc/ssl/cert.crt;
  ssl_certificate_key /etc/ssl/rsa.key;
  server_name <url>;
  proxy_set_header X-Forwarded-For $remote_addr;
  proxy_set_header X-Forwarded-Proto https;
  client_max_body_size 10M;

  location ~ \.php$ {
    try_files $uri =404;
    fastcgi_split_path_info ^(.+\.php)(/.+)$;
    fastcgi_pass unix:/opt/remi/php55/root/var/run/php-fpm/php-fpm.sock;
    fastcgi_index index.php;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;

  location / {
  try_files $uri $uri/ @rewrites;

  location @rewrites {
    rewrite ^(.*) /index.php?p=$1 last;

  # Errors

  error_page 404 /index.php;
  error_page 500 502 503 504 /50x.html;

  location = /50x.html {
    root /var/www/<url>/htdocs;

  # Enable gzip compression
  gzip on;
  gzip_comp_level 2;
  gzip_http_version 1.0;
  gzip_proxied any;
  gzip_min_length 1100;
  gzip_buffers 16 8k;
  gzip_types text/plain text/html text/css application/x-javascript text/xml application/xml application/xml+rss text/javascript;

  # Disable for IE < 6 because there are some known problems
  gzip_disable "MSIE [1-6].(?!.*SV1)";

  # Add a vary header for downstream proxies to avoid sending cached gzipped files to IE6
  gzip_vary on;

  • You doing anything in your .htaccess file that would need updating?
    – Brad Bell
    Commented Oct 7, 2015 at 22:00
  • Added my whole vhost entry for port 443
    – Jon
    Commented Oct 7, 2015 at 22:04

2 Answers 2


Yii will check for the following server environment variables when determining if it’s an SSL request:

  • HTTPS – should be set to “on”, “ON”, or “1”; or
  • HTTP_X_FORWARDED_PROTO – should be set to “https” or “HTTPS”

Apparently this is a common issue when running PHP on Nginx, since that HTTPS env variable is only an Apache convention.

Here’s an article that demonstrates how to fix it. According to that, you just need to add the following to your server config.

fastcgi_param HTTPS on;

You can probably add it right before/after your other fastcgi_param line.

  • Thanks for the answer. Should the asset settings matter for the admin panel's JS/CSS files? So on my admin login page I'm getting an error loading http://mysite.com/admin/resources/js/craft.js even though my siteUrl is set to //mysite.com. Is this URL being built some other way?
    – Jon
    Commented Oct 8, 2015 at 0:27
  • @Jon Sorry, missed that the question was for the Control Panel. Just updated my answer. Commented Oct 8, 2015 at 13:39
  • Side note: nginx's $https variable should be defined as of 1.1.11 (which is pretty jurassic) so you could use fastcgi_param HTTPS $https as well. Commented Oct 9, 2015 at 0:03
  • see my reply below, though, for additional and/or more contempory information... Commented Jan 29, 2019 at 19:35

An addition on this, probably for later versions of Craft than @brandonkelly's answer.

You also need to be careful where Asset definitions are made in the CP - specifically, under Settings>Assets>Volumes>yourAssetsName.

  • the default or practice at some point was to have urls of the form:
  • however, as of Craft 3.1, a red-lettered advisory will appear, not to use @web alias here. Indeed, with the proper form, all will work as expected, and https will be used when appropriate:

This works however you are accessing the url, even in CraftQL or element-api, because the path will always be root url-relative.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.