I followed this guide to move my local hosting from WAMP, which has been giving me a bunch of 500 errors since switching to Craft 3, to Local By Flywheel. After getting everything configured, I can access the site and everything seems to be working fine. The issue I'm having is I'm unable to access the control panel to make changes. The login screen keeps just redirecting back to the login screen after entering the credentials.

Here are the details I have as far as what's going on:

  • I know the credentials I'm entering are correct. I get an error on the login page when I put in an incorrect password
  • I've checked the Craft logs and don't see any obvious warnings or error messages related to login
  • Removing everything in the Craft log folder doesn't change anything
  • I'm running Apache (2.4.1, I believe), PHP 7.0.3, and MySQL 5.5.6

Here is the .htaccess we're using (I don't think it's the issue but I know it's a common one for this sort of stuff):

<IfModule mod_expires.c>
 ExpiresActive on
 # Perhaps better to whitelist expires rules? Perhaps.
 ExpiresDefault "access plus 1 month"
 # cache.appcache needs re-requests in FF 3.6 (thanks Remy ~Introducing HTML5)
 ExpiresByType text/cache-manifest "access plus 0 seconds"
 # Your document html
 ExpiresByType text/html "access plus 0 seconds"
 # Data
 ExpiresByType text/xml "access plus 0 seconds"
 ExpiresByType application/xml "access plus 0 seconds"
 ExpiresByType application/json "access plus 0 seconds"
 # Feed
 ExpiresByType application/rss+xml "access plus 1 hour"
 ExpiresByType application/atom+xml "access plus 1 hour"
 # Favicon (cannot be renamed)
 ExpiresByType image/x-icon "access plus 1 week"
 # Media: images, video, audio
 ExpiresByType image/gif "access plus 1 month"
 ExpiresByType image/png "access plus 1 month"
 ExpiresByType image/jpeg "access plus 1 month"
 ExpiresByType video/ogg "access plus 1 month"
 ExpiresByType audio/ogg "access plus 1 month"
 ExpiresByType video/mp4 "access plus 1 month"
 ExpiresByType video/webm "access plus 1 month"
 # Webfonts
 ExpiresByType application/x-font-ttf "access plus 1 month"
 ExpiresByType font/opentype "access plus 1 month"
 ExpiresByType application/x-font-woff "access plus 1 month"
 ExpiresByType image/svg+xml "access plus 1 month"
 ExpiresByType application/vnd.ms-fontobject "access plus 1 month"
 ExpiresByType text/css "access plus 1 year"
 ExpiresByType application/javascript "access plus 1 year"

<IfModule mod_deflate.c>
 AddOutputFilterByType DEFLATE text/html text/plain text/css application/json
 AddOutputFilterByType DEFLATE application/javascript
 AddOutputFilterByType DEFLATE text/xml application/xml text/x-component
 AddOutputFilterByType DEFLATE application/xhtml+xml application/rss+xml application/atom+xml
 Addtype font/opentype .otf
 Addtype font/truetype .ttf
 AddOutputFilterByType DEFLATE image/x-icon image/svg+xml application/vnd.msfontobject application/x-font-ttf font/opentype font/truetype

<IfModule mod_rewrite.c>
     RewriteEngine On

    # remove version numbers used for cache busting.
    # maps site.min.1234.css to site.min.css
    # See https://nystudio107.com/blog/simple-static-asset-versioning
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^(.+)\.(\d+)\.(bmp|css|cur|gif|ico|jpe?g|js|png|svgz?|webp|webmanifest)$ $1.$3 [L]

    #301 redirect with trailing slash
        RewriteCond %{REQUEST_URI} /+[^\.]+$
        RewriteRule ^(.+[^/])$ %{REQUEST_URI}/ [R=301,L]

    #Send would-be 404 requests to Craft
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-touch-icon.*\.png)$ [NC]
        RewriteRule (.+) index.php?p=$1 [QSA,L]
  AddType text/x-component .htc


The only thing that seems a bit odd is on the login page, it keeps redirecting from the HTTPS version to the HTTP version upon form submission. Same login page, but after submission it goes from HTTPs to HTTP and then I can't get past then on subsequent attempts. The rest of the site works fine on HTTPs. Not sure if that could be tied to the issue or what's going on there but wanted to call that out as being of note.

1 Answer 1


This Github issue helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem:

RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.