ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this community
I've installed an SSL on my server and I'm forcing https:// via htaccess. The entire site needs to be secured. Unfortunately, the browsers are complaining of insecure content.
For example:
<link rel="stylesheet" href="{stylesheet='assets/css.layout'}">
{site_url}
These evaluate to a URL that begin with http://.
I'm still exploring the problem, so there might be other issues.
What do I need to do in EE so that I don't get URLs that begin with http://?
In your EE config.php / site configuration, is your site URL set with http:// or https:// ? If it's not the latter, try that to see if it solves the issue. I think EE matches the site_url to the exact URL (and protocol) that you set in this configuration variable.
The trickier thing is when you have a site that's partially under HTTP and partially HTTPS. In that case, you definitely need to use add-ons and/or link site URLs coded another way to properly traverse from one to the other. (I set global variables in the config for {global:site_url} and {global:site_ssl_url}, and use those in my templates.)
Finally, for your CSS URL, you can also reference it like:
<link rel="stylesheet" href="/assets/css.layout">
or
<link rel="stylesheet" href="//yoursite.com/assets/css.layout">
(Note that web browsers will resolve the // in the URL to either http or https, to match the protocol of the current page.)
Finally, if you have the option, move your CSS to a static file outside of EE--this will improve your site performance noticeably.
It's because EE variables don't detect or utilise https by default, so you have to set them in code. The easiest way is to use an add-on:
http://devot-ee.com/add-ons/https-support
http://devot-ee.com/add-ons/dm-force-ssl
http://devot-ee.com/add-ons/force-ssl (commercial)
(In no particular order) I've not used any of these so can't recommend a specific one as I use my own plugin.
Also, here is an older article, but with some useful tips: https://exp-resso.com/blog/post/2011/08/securing-your-expressionengine-website-with-https
