Skip to main content
5 votes
Accepted

Craft Admin assets do not load over https (Apache & Cloudflare)

The solution I came to was creating an Origin Certificate on Cloudflare, installing on it on my VPS, and setting the SSL setting to Full Strict. Now admin assets are loading perfectly over https. No ....
Rjoss's user avatar
  • 136
4 votes

From a Twig template, how to retrieve the content of a HTTP header in the current request?

By checking the code, I could find a method named getHeaders() that will return all the headers of the current request. So if you want to retrieve the content of the foo header, just use: {% set ...
kant312's user avatar
  • 496
4 votes

.dev local development

This seems missing from the other answers, so I feel the need to emphasize it here... Craft does not require .dev for local development. Your local URL can be anything you want, Craft does not care. ...
Lindsey D's user avatar
  • 24k
3 votes
Accepted

When redirecting to HTTPS from www, index.php appears in URL

There are docs for removing index.php from your URLs here: https://craftcms.com/support/remove-index.php There are also docs for enforcing SSL for all CP requests here: https://craftcms.com/support/...
Brad Bell's user avatar
  • 67.5k
3 votes
Accepted

Craft 3 Admin not loading cpresources files over HTTPS

The fix was to delete the content of the /cpresources folder and that did the trick.
biko's user avatar
  • 670
3 votes
Accepted

Problem with Site Running Both HTTP & HTTPs

What web server are you running? I ask because IIS will define the $_SERVER['https'] variable even if the site is being accessed via HTTP (it's value will be 'off') and Ben's answer is only checking ...
Tom's user avatar
  • 135
3 votes
Accepted

Read POSTed JSON data from the request body

Yes, you can use getRestParams() like so: $input = craft()->request->getRestParams() A bit confusing naming there, which is why it's changing to getBodyParams() in Yii 2.
Fred Carlsen's user avatar
  • 2,997
3 votes

.dev local development

Yea Google bought .dev a few years back and now chrome forces https on all .dev domains. I switched to using .test which has been reserved. So far, so good. https://medium.engineering/use-a-dev-...
sgtpenguin's user avatar
2 votes

Login - Bad Request: The CSRF token could not be verified

Once the same problem happened for me because of server caching and it may happen because of client-side cookie/cache. Sometimes, server caching will cache the entire form including CSRF token. So if ...
shihab mm's user avatar
  • 121
2 votes

Login - Bad Request: The CSRF token could not be verified

I have exactly the same issue, clearing cookies worked for me
swalker's user avatar
  • 21
2 votes

transfer to HTTPS

Change your site url in your config file. Add a 301 redirect to your htaccess to send requests for http to https. # Redirect http to https RewriteCond %{HTTP:X-Forwarded-Proto} !=https RewriteRule .*...
foamcow's user avatar
  • 2,029
2 votes

From a Twig template, how to retrieve the content of a HTTP header in the current request?

craft.app.request.getHeaders() returns an instance of yii\web\HeaderCollection, which has a number of public methods you can use from a Twig template. For example, to see if an isAjax header is ...
Josh Harrison's user avatar
2 votes
Accepted

Sprig "Load more" not loading over https

Sprig will use whatever your site's base URL is set to, to construct the action URL. Ensure in Settings → Sites that the base URL is either set to an absolute path starting with https://, or if an ...
Ben Croker's user avatar
  • 7,536
1 vote

SSL now CP unknown errors

After much head scratching it wasn't an SSL issue. Litespeed had recently been installed on the shared server but was misconfigured. It appears the allowed header size default value was modified ...
Dr_Codswallop's user avatar
1 vote
Accepted

Can't Get Past Control Panel Login. Keeps Redirecting Back to Login Page

This Github issue helped me solve the problem and it was indeed tied to not forcing everything to SSL. Once I added the code below to my .htaccess to force all HTTP to HTTPs, it solved the problem: ...
dpayne's user avatar
  • 659
1 vote

Forcing a / with .htaccess

I don't think this is particularly Craft CMS specific problem. Just Apache .htaccess rules in general. I would try to search for and answer of Stack Overflow. I have a strong feeling it's been ...
Alex Roper's user avatar
  • 2,642
1 vote

Force redirect from HTTP to HTTPS via htaccess with multisite installation

move these lines RewriteEngine On # Send would-be 404 requests to Craft RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} !^/(favicon\.ico|apple-...
Flying Car 0013's user avatar
1 vote
Accepted

transfer to HTTPS

In example.com.nginx.ssl.conf need to insert: location / { try_files $uri/index.html $uri $uri/ /index.php?$query_string; }
Vitaliy  Badalov's user avatar
1 vote

.dev local development

If you are using Laravel Valet, the newest version takes care of that. You may either change the domain with valet domain test, or better: automatically secure your project it with valet secure. It's ...
Fred Carlsen's user avatar
  • 2,997
1 vote

Craft Admin assets do not load over https (Apache & Cloudflare)

It's probable that your Site URL in your website's config is using http rather than https. Setting it to https should force the control panel assets to load appropriately. You can change this in ...
Mutual's user avatar
  • 442
1 vote
Accepted

HTTPs Site - Redirects Go to HTTP First & Then HTTPs

Think we figured out the root cause of this - we have a load balancer in front of our origin server and, long story short, that load balancer was communicating with our origin server via HTTP, causing ...
dpayne's user avatar
  • 659
1 vote

Craft Admin assets do not load over https (Apache & Cloudflare)

Craft's default setting is 'resourceBaseUrl' => '@web/cpresources'. If your site or Docker Container runs http, Craft seems to (correctly) determine the http setup. This is why it ignores your ...
Max Strebel's user avatar
1 vote

CloudFlare Shared SSL certificate forbids CraftCMS control panel sign in

I'd give Patrol plugin a try, just activate secure connections.
Leo Leoncio's user avatar
1 vote

When redirecting to HTTPS from www, index.php appears in URL

Using MediaTemple, I have this working: #FORCE HTTPS RewriteCond %{HTTPS} !=on RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] <IfModule mod_rewrite.c> RewriteEngine On # ...
SteveO's user avatar
  • 336

Only top scored, non community-wiki answers of a minimum length are eligible