I'm running EE multi-site manager (MSM).

  1. My default site's domain (say, www.default.com) is where the /themes folder is housed.
  2. So, for my second site (say, www.site-two.com), all of the EE and third-party theme files (js, css, etc) are being pull from www.default.com/themes/*
  3. Site two is secure, using https (via .htaccess), since it's running Expresso's Store and requires SSL. Default site is not https.

My problem is that the requests to the EE and third-party theme files (from the default site) are not completing because they're being requested as https://www.default.com/themes/* instead of http://...

Here's my current .htaccess mod_rewrite section

RewriteEngine On

## -- force www -- ##
RewriteCond %{HTTP_HOST} ^site-two\.com$ [NC]
RewriteRule ^(.*)$ http://www.site-two.com/$1 [R=301,L]

## -- force https -- ##
RewriteCond %{HTTPS} off
RewriteCond %{HTTP_HOST} ^www\.site-two\.com$  [NC]
RewriteRule .* https://www.site-two.com/%1%2  [R=301,L]

## -- remove index.php -- ##
RewriteCond $1 !\.(gif|jpe?g|png)$ [NC]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ /index.php?/$1 [L]

I've tried endless .htaccess variations with no success. I don't even know if I'm wanting is possible. I'd like to avoid making www.default.com secured (more money), if possible.

NEW INFO PER ADRIAN'S FIRST ANSWER: Using Focus Lab's master config set up, I have this for the production config, which is why it at least pulling from the default site.

$env_config['default_url']      = 'http://www.default.com';
$env_config['theme_folder_url']     = $env_config['default_url'] . '/themes/';

Any help is greatly appreciated.

EDIT: Problem is this auto-generated script from the exp:store:checkout tag. See the script.src

if (!ExpressoStore.scriptElement) {
                var script = ExpressoStore.scriptElement = document.createElement("script");
                script.type = "text/javascript"; script.async = true;
                script.src = "//www.default.com/themes/third_party/store/store.js";
                (document.getElementsByTagName("head")[0] || document.getElementsByTagName("body")[0]).appendChild(script);

2 Answers 2


This isn't really an issue with your htaccess. You need to look at using a simple EE config bootstrap file such as this one to automatically set $config['theme_folder_url'] as either HTTP or HTTPS depending on whether the current request is served over HTTPS.

In the most basic form, you could probably just add this to your config.php file:

if (empty($_SERVER['HTTPS']) || strtolower($_SERVER['HTTPS']) == 'off') {
    $config['theme_folder_url'] = 'http://www.example.com/themes';
} else {
    $config['theme_folder_url'] = 'https://www.example.com/themes';
  • I should have added that I do have this setup, manually forcing http:// www. default.com/themes in config (using Focus Lab's master config). With that setting I can modify the directory (to test that I'm modifying the correct config), but http:// still gets overridden by https:// Commented Apr 15, 2013 at 12:49
  • But when you view source, are the links pointing to HTTP or HTTPS? If they are pointing directly to HTTPS, then the problem is your bootstrap and not htaccess. In that case I would expect something in your bootstrap or config files (or an extension) is overwriting the http:// part. Commented Apr 15, 2013 at 14:59
  • Found the problem: It the auto-generated script. See updated question above. Commented Apr 15, 2013 at 15:03
  • That's not a problem, it's a protocol relative URL and will use either HTTP or HTTPS according to whatever the current page is using. Commented Apr 15, 2013 at 15:08
  • 1
    I see what you mean now. You shouldn't be loading store.js from the wrong domain. In that case you need to update your config to automatically set the theme_folder_url to the current domain, and make sure your server is allowing connections to the themes/ URL from both domains. Commented Apr 15, 2013 at 15:26

That's because your .htaccess file is forcing them over a secure connection. Stepping backwards for a second do you really need ALL areas of the site to be run over a secure connection? Generally you only want the checkout and the account section to be sure as it involves sensitive form submissions. The rest of the site isn't really necessary.

So with that in mind how about changing your .htaccess file so that you only specify the URL segments you wish to protect:

# Redirect to HTTPS if not using HTTPS  
RewriteEngine On 
RewriteCond %{HTTPS} !=on
# Specify URL segments to ensure a secure connection 
RewriteCond $1 ^(member|account|checkout|system) [NC]
# Rewrite requests to above segments over HTTPS
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

So now instead of EVERY request being sent over HTTPS it will only send the segments you specify and should solve the problem.

  • Thanks for chiming in. This is what I have in fact, but the purposes of solving my problem, this detail is irrelevant. On the /checkout page, the store.js file is being pulled from the default site, but it fails because of the https being added. Commented Apr 15, 2013 at 14:49
  • Apologies, keeping this focused on the checkout page was actually the right move as the issue was specific to the checkout page. Commented Apr 15, 2013 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.